Allow to pull charts from OCI registry

[giuscri]

No description provided.

[giuscri]

Would someone write some pointers for how to implement this?

[DerEnderKeks]

I just tried to install an OCI chart and it works just fine if you put the full URI (oci://...) into the spec.chart field of a HelmChart CR. (No need to specify thespec.repo)

[chris13524]

I just tried to install an OCI chart and it works just fine if you put the full URI (oci://...) into the spec.chart field of a HelmChart CR. (No need to specify thespec.repo)

I think this works only for registries using HTTPS. When using k3d managed registries, these are HTTP, so the install errors out with failed to do request: Head "https://k3d-registry.localhost:5000/v2/mychart/manifests/0.1.0": http: server gave HTTP response to HTTPS client for me

I think this requires helm/helm#6324

[smbecker]

I ran into this issue when trying to leverage a private OCI registry. It seems that public OCI registries work by excluding the repo field and fully-qualifying the chart. However, private registries do not and the authSecret support added here only works when repo is provided, which doesn't work with oci:// registries. When installing locally, I login using docker login and then helm pull oci:// works fine as it seems to inherit the credentials. Given that it is fairly common to create a docker registry secret in the cluster so that kubelet can pull the images from the oci:// registry, I found that if you can mount that same registry secret in /home/klipper-helm/docker then it works fine. I would be glad to push a PR if there is interest but honestly not all that familiar with go, so it might take a minute.

[brandond]

@smbecker hmm, so there is no facility for hosting a repo index when using an OCI registry as the chart store?

[smbecker]

@smbecker hmm, so there is no facility for hosting a repo index when using an OCI registry as the chart store?

Helm only supports a subset of commands when targeting OCI registries. You can explicitly login but it has been my experience that when using OCI-based registries for Helm charts, then the containers are likely on the same registry as well. In that case, it is easier to just use the inherited docker authentication to login for Helm as well.