Registry login error with helm OCI private dependencies

[jerousseau]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug
Similar issue to this comment : #8266 (comment)

When setting credentials templates that match a registry but that are not given as a repository (repocreds instead), the login fails because Argo CD passes the schema oci:// as the registry URL, but helm (using oras-go) will fail because it does not support the oci:// schema, and so login command will fail

To Reproduce

1. Create an ArgoCD helm OCI repo-creds secret

apiVersion: v1
kind: Secret
metadata:
  name: argoproj-gitlab-helm-creds
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repo-creds
stringData:
  url: registry.gitlab.com/test
  enableOCI: true
  type: helm
  password: my-password
  username: my-username

2. Use a chart with a dependencie that match the repo-creds url

apiVersion: v2
name: test-chart
version: 1.0.0
dependencies:
- name: toto-spa
  version: 1.1.1
  repository: "oci://registry.gitlab.com/test/toto"

3. ArgoCD will try to login with oci scheme in url

helm registry login oci://registry.gitlab.com/test/toto --username ****** --password ******

Expected behavior
helm registry login without oci scheme in url

helm registry login registry.gitlab.com/test/toto --username ****** --password ******

Version

argocd: v2.2.5+8f981cc
  BuildDate: 2022-02-05T01:33:25Z
  GitCommit: 8f981ccfcf942a9eb00bc466649f8499ba0455f5
  GitTreeState: clean
  GoVersion: go1.16.11
  Compiler: gc
  Platform: linux/amd64``

Logs

rpc error: code = Unknown desc = `helm registry login oci://registry.gitlab.com/test/toto --username ****** --password ******` failed exit status 1: WARNING: Using --password ****** the CLI is insecure. Use --password-stdin. time="2022-02-18T11:02:49Z" level=info msg="Error logging in to v2 endpoint, trying next endpoint: Get \"https://oci/v2/\": dial tcp: lookup oci on 10.32.0.10:53: no such host" Error: Get "https://oci/v2/": dial tcp: lookup oci on 10.32.0.10:53: no such host

[turnerno8]

Any progress on getting a fix? We need to use private OCI helm repos...

[Exodus]

This seems to be fixed in v2.3.3 (I'm not sure if a previous version fixed it). I am no longer experiencing this issue.

Can anyone else here confirm the problem is fixed for them?

[Exodus]

For reference, the configuration I'm using, that works, looks as such:

The credential template ends up as a secret in the same namespace as argocd:

apiVersion: v1
kind: Secret
metadata:
  name: argocd-repo-helm-foo
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
data:
  name: foo
  enableOCI: true
  username: //redacted//
  password: //redacted//
  type: helm
  url: //redacted, looks like: foo.azurecr.io //

With an Application that looks like:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: testapp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/foo/bar
    path: charts/foo-apps/testapp
    targetRevision: HEAD
    helm:
      valueFiles:
        - values-testapp-dev.yaml
  destination:
    namespace: dev
    server: https://kubernetes.default.svc

With a chart that looks like:

apiVersion: v2
name: testapp
description: Test chart
type: application
version: "0.1.0"
appVersion: "0.1.0"
dependencies:
  - name: testapp
    version: 1.2.41
    repository: oci://foo.azurecr.io/helm

[cippaciong]

@Exodus still not working for me, I can't understand what I'm missing.

This is my configuration:

apiVersion: v1
kind: Secret
metadata:
  name: lab-helm-chart-credentials
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  name: dhl3
  url: <company>.azurecr.io/<path>
  type: helm
  enableOCI: "true"
  username: //redacted//
  password: //redacted//

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: dhl-helm-oci
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitlab.<company.tld>/<path>.git
    path: environments/dhl-helm-oci
    targetRevision: HEAD
  destination:
    namespace: dhl-helm-oci
    server: https://kubernetes.default.svc

apiVersion: v2
name: dhl-helm-oci
description: Test Helm dependencies for ArgoCD
type: application
version: 0.1.0
appVersion: "1.0.0"
dependencies:
- name: dhl3
  version: 0.5.0
  repository: oci://<company>.azurecr.io/<path>

This is the error I get with that configuration but I had different errors with different combinations of the configuration, including the one described in this issue:

rpc error: code = Unknown desc = Manifest generation error (cached): `helm dependency build` failed exit status 1: Error: could not retrieve list of tags for repository oci://<company>.azurecr.io/<path>: GET "https://<company>.azurecr.io/v2/<path>/tags/list": unexpected status code 401: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.

[Exodus]

This is an issue I've been tracking. It would seem it's related to this issue in herm for which we bumped the helm version in version 2.4. 2.4 has a release candidate out already for those eager to test this.

If you're using Azure Container Registry, this can also be circumvented by using a service principal with contributor access to the ACR instead of a token (read) with a scope.

[cippaciong]

After @Exodus help on slack, I can also confirm that my problem is solved using version 2.4 (tested with v2.4.0-rc2).

This issue can probably be closed

[turnerno8]

Mine works now with v2.4.0-rc1, once fixing the first issues by upgrading I had an issue regarding project allowed repos and namespaces

[ivanaguilario]

Can confirm it works in v2.4.2 using OCI with Google Cloud Artifact Registry

[dileepbg]

With below arocd cmd it works in v2.4.2 but its not working declarative approach.

argocd repo add containerRegistry.azurecr.io
--type helm
--name private-repo
--enable-oci
--username $USER_NAME
--password $PASSWORD

any permanent fix for this issue would help alot.

[mehdicopter]

Can confirm it works in v2.4.2 using OCI with Google Cloud Artifact Registry

how did you manage to make it work ?

[alexef]

@mehdicopter (and anyone else affected) for us, the way to authenticate is specifying the repo without any protocol.

i.e. instead of oci://registry.gitlab.com/test/toto -> registry.gitlab.com/test/toto

In the declarative approach, Secret.url and Application.spec.helm.repoURL would also have to be set without protocol.