iac/helm/helm-host-namespace

Helm values share a host namespace

highHelmiac-helm

What it detects

`hostNetwork` / `hostPID` / `hostIPC: true` place the pod in the node's network, process, or IPC namespace — breaking pod isolation and exposing other workloads on the node.

Remediation

Remove the host-namespace flag unless the chart is a node-level agent that genuinely requires it.

How it runs

Run against Helm chart values files (values.yaml / values-*.yaml), which aren't rendered manifests so the Kubernetes layer skips them. Line-based checks for insecure chart defaults that propagate into every rendered workload.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.