rook-ceph-operator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The helm install instructions fetch and use remote content at runtime (https://charts.ceph.io/ceph-csi-operator and https://raw.githubusercontent.com/rook/rook/v1.20.2/deploy/charts/ceph-csi-drivers/values.yaml), which directly controls what is installed/applied into the cluster and thus can cause remote code to be executed during deployment.