Helm v4 fails with OCI registry

[tobias-karlsson]

What happened?

With Helm v4, running in Github Actions

Error: invalid reference: invalid registry "ghcr.io/<redacted>/microservice-chart"

Regression? We saw this with, I believe it was, 3.17 too.

What did you expect to happen?

With Helm v3.19.1, running in Github Actions

Pulled: ghcr.io/<redacted>/microservice-chart:0.2.103

How can we reproduce it (as minimally and precisely as possible)?

Try installing a chart from Github Packages. I'm sorry for the useless "reproduction instructions", but it's an internal chart :/

Helm version

Details

Installing v4.0.0
  Downloading 'v4.0.0' from 'https://get.helm.sh'
  /usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /home/runner/work/_temp/68e48e8f-7e86-4bc0-bda1-46c4159a2d70 -f /home/runner/work/_temp/649d67e4-1cc9-4b86-8367-24122fc6390d
Helm tool version 'v4.0.0' has been cached at /opt/hostedtoolcache/helm/4.0.0/x64/linux-amd64/helm

Kubernetes version

1.33.3

[TerryHowe]

That error would be coming from https://github.com/oras-project/oras-go/blob/main/registry/reference.go#L196 and my guess would be somehow it the host/domain is empty.

Any chance you could put command line you are using with the repo redacted? Any odd characters in repo name?

[tobias-karlsson]

I'm guessing it's the registry login that fails?

Our Github Action is doing helm registry login ghcr.io/<redacted>/microservice-chart --username <redacted> --password-stdin

Edit: the organization name is just using a-z.

[benoittgt]

Here I have no issues with:

❯ bin/helm registry login ghcr.io --username benoittgt --password "$(gh auth token)"
level=WARN msg="using --password via the CLI is insecure. Use --password-stdin"

❯ ./bin/helm pull oci://ghcr.io/benoittgt/busyb/busyb --version 100.100.100
Pulled: ghcr.io/benoittgt/busyb/busyb:100.100.100
Digest: sha256:886ed0347b3c53a3f06e45219ed99acc94b715e62765f7034930e3b7f0e7bf70

[tobias-karlsson]

Here I have no issues with:

❯ bin/helm registry login ghcr.io --username benoittgt --password "$(gh auth token)"
level=WARN msg="using --password via the CLI is insecure. Use --password-stdin"

❯ ./bin/helm pull oci://ghcr.io/benoittgt/busyb/busyb --version 100.100.100
Pulled: ghcr.io/benoittgt/busyb/busyb:100.100.100
Digest: sha256:886ed0347b3c53a3f06e45219ed99acc94b715e62765f7034930e3b7f0e7bf70

Probably because you just use ghcr.io while we use ghcr.io/<redacted>/microservice-chart. Which makes sense, but I believe the way we do it is valid too, and it has always worked before, and we'd rather not change our shared github action and have to verify it works for all our workflows if this is a Helm issue that can be easily solved.

[kejne]

We have exactly the same issue when accessing AWS ECR like so:

helm registry login XXXXXXXXXXXXX.dkr.ecr.eu-west-1.amazonaws.com/charts --username AWS --password-stdin

# as well as:

helm registry login XXXXXXXXXXXXX.dkr.ecr.eu-west-1.amazonaws.com --username AWS --password-stdin

[TerryHowe]

I guess one thing is you should just use the domain to login like helm registry login XXXXXXXXXXXXX.dkr.ecr.eu-west-1.amazonaws.com --username AWS --password-stdin same with ghcr although it might just ignore the namespace/repo.

Second, with AWS, you are running the CLI to generate your token, right?

There may be an issue, but there isn't much I can do unless I have some instructions to reproduce

This is the command I use for ghcr (I don't bother logging in)

helm push mychart2-0.1.0.tgz oci://ghcr.io/terryhowe --debug --username $GHCR_USER --password $GHCR_TOKEN

[PKatBK]

+1

[TerryHowe]

I need to look at the code, but a change may have been made to v3 for login scope that we didn't want in v4. This may be an intentional breaking change.

[TerryHowe]

https://github.com/helm/helm/blob/dev-v3/pkg/registry/client.go#L259

Sorry, I don't think this was done, the documentation.

[TerryHowe]

This is related to https://github.com/helm/community/pull/391/files

[benoittgt]

Should we add a warning log @TerryHowe ?

[TerryHowe]

Should we add a warning log

Good idea #31519

[tobias-karlsson]

Oh snap. I was hoping this would be something unintentional, as that would've saved me some work, but nothing to it but update my actions and get to testing then :)