Wildcard support in OCI Helm Repos not working if build identifier set in version

[xashr]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

With #10641 Argo introduced the "Wildcard support in OCI Helm Repositories targetRevision".

A full semver compatible chart version looks like this: <version core> "-" <pre-release> "+" <build>, e.g. 1.2.3-rc1+abcdefgh.
Bug: Argo fails to resolve the targetRevision: "*" wildcard if a build identifier is part of the chart version in the OCI repo.

Background info: OCI tags are not semver compatible. The "+" character is not allowed. Helm worked around this by converting "+" to "_" before pushing to the OCI repo and vice versa when pulling from the repo.

Helm prints the following hint when this happens:

OCI artifact references (e.g. tags) do not support the plus sign (+). To support
storing semantic versions, Helm adopts the convention of changing plus (+) to
an underscore (_) in chart version tags when pushing to a registry and back to
a plus (+) when pulling from a registry.

Argo CD is not respecting this convention and considers a tag "1.2.3-rc1_abcdefgh" invalid semver.

To Reproduce

• Create OCI repo
• Push chart to OCI repo with a version including a build identifier (e.g. 1.2.3+abcdefgh)
• Register OCI repo with Argo CD
• Create Argo Application referencing the chart and setting targetRevision: "*"
• -> Argo CD prints the errors shown below (Logs)

Expected behavior

Argo CD respects Helm convention how build identifiers are handled in case of OCI registries and converts "_" back to "+" before trying to find matching versions. Argo CD successfully installs latest Helm chart matching the targetRevision wildcard, even if build identifier is included in the chart version.

Version

2.7.4 and master (2023-06-16)

Logs

UI Shows:

repo-server {"error":"no version for constraints: constraint not found in 1 tags","grpc.code":"Unknown","grpc.method":"GenerateManifest","grpc.service":"repository.RepoServerService","grpc.start_time":"2023-06-16T11:15:56Z","grpc.time_ms":161.567,"level":"error","msg":"finished unary call with code Unknown","span.kind":"server","system":"grpc","time":"2023-06-16T11:15:56Z"}

repo-server with debug level:

repo-server {"level":"debug","msg":"Invalid semantic version: 1.2.3_553b3905","time":"2023-06-16T11:21:56Z"}

[kyleli666]

I cannot even set targetRevision: "*"

Unable to save changes: application spec for ww-gitops is invalid: InvalidSpecError: Unable to generate manifests in : rpc error: code = Unknown desc = unable to get tags: failed to get tags: failed tags part: invalid response: 404 Not Found {"error":"Not Found"}

ArgoCD version v2.7.6+00c914a.dirty

Hi @xashr, may I ask how did you set targetRevision: "*" successfully? I cannot set it with oci helm repos, also not in 2.7.4. With https helm repo, it works and also targetRevision: x works.

[xashr]

@kyleli666, we faced that 404 error, when including the path in the repoURL. It only works with

repoURL: <domain-name>, e.g. registry.example.com
chart: <full path to chart>, e.g. the/path/to/your/chart

[kyleli666]

@xashr Thanks a lot! It's promising, but for those public helm repos it is now reporting 401 Unauthorized

Unable to save changes: application spec for ww-gitops is invalid: InvalidSpecError: Unable to generate manifests in : rpc error: code = Unknown desc = unable to get tags: failed to get tags: failed tags part: invalid response: 401 Unauthorized {"errors":[{"code":"UNAUTHORIZED","message":"authentication required"}]}

[xashr]

@kyleli666 The auth problem (for our private registry) only got fixed with a build from master (upcoming 2.8 release)