Skip to content

mTLS support for helm extensions from OCI registries #5932

@byDimasik

Description

@byDimasik

Is your feature request related to a problem? Please describe.

In #5901, we've implemented custom CA cert support for extensions from OCI registries.

v1beta1.Repository also allows setting cert and key files that are currently used for classic helm repos, but are unsupported by OCI registries.

The idea of supporting mTLS for OCI registries came up during the review of #5901 that implemented custom TLS transport support for OCI registry clients, but only considered CA cert, while client auth certs remained ignored.

Describe the solution you would like

We could reuse certFile and keyFile fields of v1beta1.Repository to implement mTLS support for OCI registries.

Describe alternatives you've considered

n/a

Additional context

Initial discussion about supporting mTLS for OCI registries started while discussing #5877 (comment)

Later, #5901 implemented CA cert support for OCI registries leaving mTLS behind due to limited time constraints and to avoid scope creep.

We do not have a request for this feature from anyone yet, but after #5901, it should be relatively easy to implement if/when needed.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions