checkov icon indicating copy to clipboard operation
checkov copied to clipboard

Checkov tries to render subcharts on their own

Open PascalTurbo opened this issue 11 months ago • 1 comments

Describe the issue When running checkov for a helm chart with subcharts, the expected behavior is, that the chart is rendered "as one". But obviously also the subcharts are rendered for their own so useless warnings are thrown.

Examples

The helm chart contains two subchart. Both of them has no own values.yaml because they are not deployable for their own. The values are defined as global values in mychart/values.yaml which leads to a valid k8s template when running helm template.

mychart

  • subchart1
  • subchart2

When now running checkov on this chart, it will throw a waring like this:

[ThreadPoolEx] [WARNI]  Failed processing helm chart subchart1 at dir: ./mychart/charts/subchart1. Working dir: /var/folders/4b/gn_pv_51325f8z_xpzsxzxf40000gn/T/tmppe1045ng. Failure details: Error: template: subchart1/templates/serviceaccount.yaml:6:6: executing "subchart1/templates/serviceaccount.yaml" at <include "mychart.namespace" .>: error calling include: template: no template "mychart.namespace" associated with template "gotpl"

Version (please complete the following information):

  • Checkov Version 3.2.20

Additional context

I've tried to skip the charts dir, but then checkov ignores the subcharts completely. Maybe the above behavior is valid in some scenarios. So an option would be great to skip individual rendering of subcharts while preventing rendering of subchats in context of the whole chart.

PascalTurbo avatar Feb 27 '24 07:02 PascalTurbo