Language: TypeScript
Label: safe
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
async function deployKubernetesMonitor(
  imageOptions: IImageOptions,
  deployOptions: IDeployOptions,
): Promise<void> {
  if (!existsSync(helmPath)) {
    await downloadHelm();
  }

  const imageNameAndTag = imageOptions.nameAndTag.split(':');
  const imageName = imageNameAndTag[0];
  const imageTag = imageNameAndTag[1];
  const imagePullPolicy = imageOptions.pullPolicy;

  await exec(
    `${helmPath} upgrade --install snyk-monitor ${helmChartPath} --namespace snyk-monitor ` +
      `--set image.repository=${imageName} ` +
      `--set image.tag=${imageTag} ` +
      `--set image.pullPolicy=${imagePullPolicy} ` +
      '--set integrationApi=https://api.dev.snyk.io/v2/kubernetes-upstream ' +
      `--set clusterName=${deployOptions.clusterName} ` +
      '--set nodeSelector."kubernetes\\.io/os"=linux ' +
      '--set pvc.enabled=true ' +
      '--set pvc.create=true ' +
      '--set log_level="INFO" ' +
      '--set rbac.serviceAccount.annotations."foo"="bar" ' +
      '--set volumes.projected.serviceAccountToken=true ' +
      '--set securityContext.fsGroup=65534 ' +
      '--set skopeo.compression.level=1 ' +
      '--set workers.count=5 ' +
      '--set sysdig.enabled=true ',
  );
  console.log(
    `Deployed ${imageOptions.nameAndTag} with pull policy ${imageOptions.pullPolicy}`,
  );
}