Helm pull fails if repo URL contains Azure Blob SAS token

[epierotto]

Output of helm version:

version.BuildInfo{Version:"v3.10.0", GitCommit:"ce66412a723e4d89555dc67217607c6579ffcb21", GitTreeState:"clean", GoVersion:"go1.19.1"}

Output of kubectl version:
Not applicable

Cloud Provider/Platform (AKS, GKE, Minikube etc.):
Helm repo on Azure Blob with SAS token

We use Azure Blob as Helm repo.
To authenticate we issue SAS tokens with required permissions.
This works perfectly fine if you add the Helm repo

$ helm repo add test 'https://testhelmrepos.blob.core.windows.net/test/upstream/?sp=rl&st=2022-10-26T06:27:46Z&se=2022-10-26T14:27:46Z&spr=https&sv=2021-06-08&sr=c&sig=6AFsNmWcqdm25UeIzOyvfoqPLk3iJjPClu6J6C93rOk%3D'

$ helm repo list
NAME                            URL                                                                                                                                                                                                                                                                                                                                 
test                            https://testhelmrepos.blob.core.windows.net/test/upstream/?sp=rl&st=2022-10-26T06:27:46Z&se=2022-10-26T14:27:46Z&spr=https&sv=2021-06-08&sr=c&sig=6AFsNmWcqdm25UeIzOyvfoqPLk3iJjPClu6J6C93rOk%3D

You can also pull charts by referencing the added Helm repo

$ helm pull --destination /tmp/test --version 12.0.3 test/nginx

What does not work is pulling the Helm chart by providing the repo URL containing the SAS token:

$ helm pull --destination /tmp/test --version 12.0.3 --repo 'https://testhelmrepos.blob.core.windows.net/test/upstream/?sp=rl&st=2022-10-26T06:27:46Z&se=2022-10-26T14:27:46Z&spr=https&sv=2021-06-08&sr=c&sig=6AFsNmWcqdm25UeIzOyvfoqPLk3iJjPClu6J6C93rOk%3D' nginx
Error: failed to fetch https://testhelmrepos.blob.core.windows.net/test/upstream/nginx-12.0.3.tgz : 404 The specified resource does not exist.

You can clearly see in the error that the SAS token is missing from the contructed URL.
If you use curl with the correct URL it just works.

$ curl -O 'https://testhelmrepos.blob.core.windows.net/test/upstream/?sp=rl&st=2022-10-26T06:27:46Z&se=2022-10-26T14:27:46Z&spr=https&sv=2021-06-08&sr=c&sig=6AFsNmWcqdm25UeIzOyvfoqPLk3iJjPClu6J6C93rOk%3D/nginx-12.0.3.tgz'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   408  100   408    0     0    968      0 --:--:-- --:--:-- --:--:--   987
$  ls nginx-12.0.3.tgz
nginx-12.0.3.tgz

[phil9909]

I don't think https://testhelmrepos.blob.core.windows.net/test/upstream/?sp=rl&st=2022-10-26T06:27:46Z&se=2022-10-26T14:27:46Z&spr=https&sv=2021-06-08&sr=c&sig=6AFsNmWcqdm25UeIzOyvfoqPLk3iJjPClu6J6C93rOk%3D/nginx-12.0.3.tgz would be correct behavior here.

I think it should be https://testhelmrepos.blob.core.windows.net/test/upstream/nginx-12.0.3.tgz?sp=rl&st=2022-10-26T06:27:46Z&se=2022-10-26T14:27:46Z&spr=https&sv=2021-06-08&sr=c&sig=6AFsNmWcqdm25UeIzOyvfoqPLk3iJjPClu6J6C93rOk%3D, would that work as well?
Notice: in the first url the nginx-12.0.3.tgz is simply string-appended, while I'd suggest that it should be appended to the path of the url (like already done) and preserve any query string (anything following the ?, which is currently missing).

Unfortunately curl -O 'https://testhelmrepos.blob.core.windows.net/... returns Could not resolve host: testhelmrepos.blob.core.windows.net for me, so I can not test this.

[epierotto]

Hi @phil9909,
I agree that the query part of the URL should be at the end.

I've set up a new storage account so you can use it for your tests.

helm repo add gh11472 'https://gh11472.blob.core.windows.net/gh11472/gh11472?sp=r&st=2022-11-05T07:11:58Z&se=2023-01-01T15:11:58Z&spr=https&sv=2021-06-08&sr=c&sig=Y%2BboUczU0vALRExIkjgEPf6IMQ6QLf3l91EmGHBw%2BTw%3D'

helm pull --destination . --version 4.3.0 --repo 'https://gh11472.blob.core.windows.net/gh11472/gh11472/?sp=r&st=2022-11-05T07:11:58Z&se=2023-01-01T15:11:58Z&spr=https&sv=2021-06-08&sr=c&sig=Y%2BboUczU0vALRExIkjgEPf6IMQ6QLf3l91EmGHBw%2BTw%3D' ingress-nginx
Error: failed to fetch https://gh11472.blob.core.windows.net/gh11472/gh11472/ingress-nginx-4.3.0.tgz : 404 The specified resource does not exist.

And you can also reach it with curl if necessary

curl -o ingress-nginx-4.3.0.tgz 'https://gh11472.blob.core.windows.net/gh11472/gh11472/ingress-nginx-4.3.0.tgz?sp=r&st=2022-11-05T07:11:58Z&se=2023-01-01T15:11:58Z&spr=https&sv=2021-06-08&sr=c&sig=Y%2BboUczU0vALRExIkjgEPf6IMQ6QLf3l91EmGHBw%2BTw%3D'

[joejulian]

I used your repo add command and could fetch it with helm pull --destination . --version 4.3.0 gh11472/nginx-ingress but could also not fetch it with the repo flag.