You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently our Helm Charts do not specify a certain namespace on default.
As best practice we should specify a custom namespace to deploy to when the user does not overwrite it during deployment.
I have investigated this issue and have come to the conclusion that this is not really something we want to include in our BPDM charts. I find it very confusing why KICS is actually recommending this as a best practice even with a MEDIUM warning while consensus on the Helm maintainers is that it is best practice to NOT include namespaces in the Helm template definitions: helm/helm#5465
One apparent reason why you wouldn't want to do this is the lack of support for default namespaces in subcharts. If you define a namespace in the BPDM templates then you would also need to define the default namespace in the subcharts. Otherwise the subcharts and the BPDM charts are installed in different namespaces on default which breaks the deployment.
For this reason Helm clearly states to use the "--namespace" argument when installing deployments and not define custom namespace in the templates. If nobody has a great solution for this issue I would recommend to ignore further security issues for this. At the very least I would not consider namespaces to be "recommended" (contrary to what KICS suggests) and highly debated. Therefore it is not suitable to make explicitely stating namespaces in the templates a requirement.
Currently our Helm Charts do not specify a certain namespace on default.
As best practice we should specify a custom namespace to deploy to when the user does not overwrite it during deployment.
This relates to warnings like these: https://github.com/eclipse-tractusx/bpdm/security/code-scanning/4651
The text was updated successfully, but these errors were encountered: