Warehouse - Not picking up credentials for Harbor Helm charts from secret

[stephenpope]

Checklist

• I've searched the issue queue to verify this is not a duplicate bug report.
• I've included steps to reproduce the bug.
• I've pasted the output of kargo version.
• I've pasted logs, if applicable.

Description

When adding a warehouse resource to a private Harbor OCI Helm chart. The credentials I have put in my secret do not seem to be picked up. The process is erroring saying it is unable to authenticate.

Steps to Reproduce

Note: name field left blank as per documentation when dealing with OCI charts.

Secret

apiVersion: v1
kind: Secret
metadata:
  name: helm-repo
  namespace: kargo-project
  labels:
    kargo.akuity.io/cred-type: helm
data:
  password: XXXX
  repoURL: oci://harbor.domain.io
  username: XXXX
type: Opaque

Warehouse

apiVersion: kargo.akuity.io/v1alpha1
kind: Warehouse
metadata:
  name: my-warehouse
  namespace: kargo-project
spec:
  freightCreationPolicy: Automatic
  interval: 5m0s
  subscriptions:
  - chart:
      discoveryLimit: 20
      repoURL: oci://harbor.domain.io/platform-charts/myapplication
      semverConstraint: ^0.2.0

Error

Unable to discover artifacts: error discovering charts: error discovering latest chart versions in repository "oci://harbor.domain.io/platform-charts/myapplication":

error retrieving versions of chart "" from repository "oci://harbor.domain.io/platform-charts/myapplication": 

error retrieving versions of chart from repository "oci://harbor.domain.io/platform-charts/myapplication":
 GET "https://harbor.domain.io/v2/platform-charts/myapplication/tags/list": unexpected status code 401: 

unauthorized: unauthorized to access repository: platform-charts/myapplication, action: pull: unauthorized to access repository: platform-charts/myapplication, action: pull

Other attempts

I have tried updating the secret to have different combinations of URL ...

• oci://harbor.domain.io
• https://harbor.domain.io
• oci://harbor.domain.io/platform-charts
• oci://harbor.domain.io/platform-charts/myapplication
• https://harbor.domain.io/v2/platform-charts

.. all without any luck.

Credentials : When I try "https://harbor.domain.io/v2/platform-charts/myapplication/tags/list" with the correct credentials it returns so my conclusion is that it is not matching/picking up credentails.

Version

Client Version: 1.6.1
Server Version: v1.6.1

[krancour]

I think this may simply be that "oci://harbor.domain.io" != "oci://harbor.domain.io/platform-charts/myapplication".

I assume your intention was to use one set of credentials for all chart repos anywhere in the oci://harbor.domain.io registry, in which case, the solution is probably as simple as modifying your secret like this:

apiVersion: v1
kind: Secret
metadata:
  name: helm-repo
  namespace: kargo-project
  labels:
    kargo.akuity.io/cred-type: helm
stringData:
  password: XXXX
  repoURL: "^oci://harbor.domain.io/"
  repoURLIsRegex: "true"
  username: XXXX
type: Opaque

[stephenpope]

Thanks for looking. Ive tried your suggestion and it its still doing the same thing. I feel more confident that it is matching/using the credentials

• Is there a log i could turn on that shows if it has matched the secret correctly ?

• Could it be because the secret username is robot$pull - (its the harbor way of naming robot users) ive had issues in other places with a dollar being in the name and causing weird behaviour.

Im doing some other investigations today mainly around seeing if i can get another set of credentials without a $ in them to try.

Thanks for your time !

[krancour]

Is there a log i could turn on that shows if it has matched the secret correctly ?

If you increase the log level to DEBUG you should at least be able to distinguish between the credentials not being found and the credentials not working.

I will try to replicate your issue as soon as I've got a moment.

[krancour]

Oh... I have a hunch. The oci:// is being dropped from oci://harbor.domain.io/platform-charts/myapplication when the url is normalized before searching for a matching credential. Then it no longer will match that regex.

Try dropping oci:// from the regex.

This seems like an edge case where normalization logic is working against the use of a regular expression. If I'm right, I'll see what I can do about this.

[stephenpope]

Bingo ! Good hunch :) That worked.

^harbor.domain.io/ matched :) I have freight !

Thanks so much for the help.

[stephenpope]

Unless you want to track this for a documentation update .. this can be closed whenever you like.

[krancour]

I'll leave it open for now... there might be something I can do in the code to help with this edge case.

[krancour]

Created #4833