Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactoring: Custom Chart Namespace #1151

Closed
nicoprow opened this issue Dec 10, 2024 · 1 comment
Closed

Refactoring: Custom Chart Namespace #1151

nicoprow opened this issue Dec 10, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@nicoprow
Copy link
Contributor

Currently our Helm Charts do not specify a certain namespace on default.
As best practice we should specify a custom namespace to deploy to when the user does not overwrite it during deployment.

This relates to warnings like these: https://github.com/eclipse-tractusx/bpdm/security/code-scanning/4651

@nicoprow nicoprow added the enhancement New feature or request label Dec 10, 2024
@nicoprow nicoprow added this to the BPDM v6.3.0 / R25.03. milestone Dec 10, 2024
@nicoprow nicoprow self-assigned this Dec 10, 2024
@nicoprow nicoprow moved this to New in BPDM Kanban Dec 11, 2024
@nicoprow nicoprow moved this from New to 🔖 Refined in BPDM Kanban Dec 13, 2024
@nicoprow
Copy link
Contributor Author

nicoprow commented Jan 15, 2025

I have investigated this issue and have come to the conclusion that this is not really something we want to include in our BPDM charts. I find it very confusing why KICS is actually recommending this as a best practice even with a MEDIUM warning while consensus on the Helm maintainers is that it is best practice to NOT include namespaces in the Helm template definitions: helm/helm#5465

One apparent reason why you wouldn't want to do this is the lack of support for default namespaces in subcharts. If you define a namespace in the BPDM templates then you would also need to define the default namespace in the subcharts. Otherwise the subcharts and the BPDM charts are installed in different namespaces on default which breaks the deployment.

For this reason Helm clearly states to use the "--namespace" argument when installing deployments and not define custom namespace in the templates. If nobody has a great solution for this issue I would recommend to ignore further security issues for this. At the very least I would not consider namespaces to be "recommended" (contrary to what KICS suggests) and highly debated. Therefore it is not suitable to make explicitely stating namespaces in the templates a requirement.

@github-project-automation github-project-automation bot moved this from 🔖 Refined to ✅ Done in BPDM Kanban Jan 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
Archived in project
Development

No branches or pull requests

1 participant