<p>This Kubernetes Pod object has an Env whose value is a string with one single quote <code>'&quot;0.0.0.0/0&quot;'</code>.</p>
<pre class="lang-golang prettyprint-override"><code>    clientSet, err := initClientSet()
    if err != nil {
        klog.ErrorS(err, &quot;failed to init clientSet&quot;)
        return err
    }
    ctx := context.Background()

    job := &amp;batchv1.Job{
        TypeMeta: metav1.TypeMeta{
            Kind:       &quot;Job&quot;,
            APIVersion: &quot;batch/v1&quot;,
        },
        ObjectMeta: metav1.ObjectMeta{
            Name: &quot;tf-poc&quot;,
        },
        Spec: batchv1.JobSpec{
            Template: v1.PodTemplateSpec{
                Spec: v1.PodSpec{
                    Containers: []v1.Container{{
                        Name:            &quot;tf-poc&quot;,
                        Image:           &quot;nginx:1.9.4&quot;,
                        ImagePullPolicy: v1.PullIfNotPresent,
                        Env:             []v1.EnvVar{{Name: &quot;TF_VAR_security_ips&quot;, Value: &quot;'\&quot;0.0.0.0/0\&quot;'&quot;}},
                    },
                    },
                    RestartPolicy: v1.RestartPolicyOnFailure,
                },
            },
        },
    }
    j, err := clientSet.BatchV1().Jobs(&quot;default&quot;).Create(ctx, job, metav1.CreateOptions{})
</code></pre>
<p>After it was created by Kubernetes client-go (as above) or Controller-runtime, the one single quote string became three single quotes.</p>
<pre class="lang-sh prettyprint-override"><code>spec:
  backoffLimit: 6
  completions: 1
  parallelism: 1
  selector:
    matchLabels:
      controller-uid: 53c93df0-b3b5-4dbc-b1d8-2a77316176a1
  template:
    metadata:
      creationTimestamp: null
      labels:
        controller-uid: 53c93df0-b3b5-4dbc-b1d8-2a77316176a1
        job-name: tf-poc
    spec:
      containers:
      - env:
        - name: TF_VAR_security_ips
          value: '''&quot;0.0.0.0/0&quot;'''
</code></pre>
<p>Here is a Kubernetes Job manifest in a Yaml file.</p>
<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  name: poc
spec:
  backoffLimit: 2147483647
  completions: 1
  parallelism: 1
  template:
    spec:
      containers:
        - command:
            - bash
            - -c
            - tail -f /dev/null
          env:
            - name: TF_VAR_security_ips
              value: '&quot;0.0.0.0/0&quot;'
          image: nginx:1.9.4
          imagePullPolicy: IfNotPresent
          name: terraform-executor
      restartPolicy: OnFailure
</code></pre>
<p>If I created it by <code>kubectl apply -f</code>, it worked as expected.</p>
<pre class="lang-sh prettyprint-override"><code>spec:
  backoffLimit: 2147483647
  completions: 1
  parallelism: 1
  selector:
    matchLabels:
      controller-uid: 1525d501-09f4-419e-8989-eb27ea4ddab5
  template:
    metadata:
      creationTimestamp: null
      labels:
        controller-uid: 1525d501-09f4-419e-8989-eb27ea4ddab5
        job-name: poc
    spec:
      containers:
      - command:
        - bash
        - -c
        - tail -f /dev/null
        env:
        - name: TF_VAR_security_ips
          value: '&quot;0.0.0.0/0&quot;'
</code></pre>
<p>How can make client-go or controller-runtime not generate three single quotes? Just keep the original number of single quotes.</p>

zzxwill
<p>You're getting the correct value from your Go code and just seeing a YAML serialization artifact.</p>
<p>In YAML, strings can be wrapped in single or double quotes.  Since the value string starts with a quote character, it has to be quoted so that it's possible to escape the quotes inside the string.  The serializer chose single quotes; inside a <a href="https://yaml.org/spec/1.2.2/#732-single-quoted-style" rel="nofollow noreferrer">single-quoted string</a> a double single quote <code>''</code> is the way to escape a single quote (and other characters can't be escaped).</p>
<pre class="lang-yaml prettyprint-override"><code>#      v               v start/end of string quoting
value: '''&quot;0.0.0.0/0&quot;'''
#       ^^           ^^  escaped single quotes
</code></pre>
<p>You could equivalently do this with <a href="https://yaml.org/spec/1.2.2/#731-double-quoted-style" rel="nofollow noreferrer">double quotes</a> and it would look exactly like your Go code</p>
<pre class="lang-yaml prettyprint-override"><code>#      v             v start/end of string quoting
value: &quot;'\&quot;0.0.0.0\&quot;'&quot;
#        ^^       ^^   escaped double quotes
</code></pre>
<p>Your latter examples are not producing the same string.  They are a YAML single-quoted string, that contains a string with double quotes but no single quotes.  (Try <code>kubectl exec job/poc -- sh -c 'echo $TF_VAR_security_ips'</code> and see what comes back.)</p>
