search

bridgecrewio / checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
https://www.checkov.io/
Apache License 2.0
7.13k stars 1.12k forks source link

Checkov tries to render subcharts on their own #6052

Open PascalTurbo opened 8 months ago

PascalTurbo commented 8 months ago

Describe the issue When running checkov for a helm chart with subcharts, the expected behavior is, that the chart is rendered "as one". But obviously also the subcharts are rendered for their own so useless warnings are thrown.

Examples

The helm chart contains two subchart. Both of them has no own values.yaml because they are not deployable for their own. The values are defined as global values in mychart/values.yaml which leads to a valid k8s template when running helm template.

mychart

When now running checkov on this chart, it will throw a waring like this:

[ThreadPoolEx] [WARNI]  Failed processing helm chart subchart1 at dir: ./mychart/charts/subchart1. Working dir: /var/folders/4b/gn_pv_51325f8z_xpzsxzxf40000gn/T/tmppe1045ng. Failure details: Error: template: subchart1/templates/serviceaccount.yaml:6:6: executing "subchart1/templates/serviceaccount.yaml" at <include "mychart.namespace" .>: error calling include: template: no template "mychart.namespace" associated with template "gotpl"

Version (please complete the following information):

Additional context

I've tried to skip the charts dir, but then checkov ignores the subcharts completely. Maybe the above behavior is valid in some scenarios. So an option would be great to skip individual rendering of subcharts while preventing rendering of subchats in context of the whole chart.

stale[bot] commented 2 months ago

Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at codifiedsecurity.slack.com Thanks!