Show Installed Chart Source Location or Source Repository URL

[mikeln]

Use case: Cluster Admin needs to determine where an installed chart came from purely from querying a running cluster. i.e Which file location or chart repository or whatever each chart came from. The given admin may or may not have access to the original chart yaml.

It appears that none of the helm commands are able to return this information, and that said information is probably not recorded in the first place.

It would be useful as an option to the helm list/ls command and the helm get command.

Output of helm version:
Client: &version.Version{SemVer:"v2.7.2", GitCommit:"8478fb4fc723885b155c924d1c8c410b7a9444e6", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.7.2", GitCommit:"8478fb4fc723885b155c924d1c8c410b7a9444e6", GitTreeState:"clean"}

Output of kubectl version:
Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.6", GitCommit:"6260bb08c46c31eea6cb538b34a9ceb3e406689c", GitTreeState:"clean", BuildDate:"2017-12-21T06:34:11Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.0", GitCommit:"925c127ec6b946659ad0fd596fa959be43f0cc05", GitTreeState:"clean", BuildDate:"2017-12-15T20:55:30Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}

Cloud Provider/Platform (AKS, GKE, Minikube etc.):
AWS

[bacongobbler]

helm get manifest and helm get values both provide information on the manifests submitted to tiller, but not the "origin" of the chart as that's stripped by the helm client.

For example:

><> helm get manifest $(helm last)

---
# Source: traefik/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
[...]
><> helm get values $(helm last)
{}

Will that work for you, or are you looking for a way to track the origin URL where the chart came from? Given helm's current architecture (helm client fetches the chart from the repo, loads from disk into memory, ships the manifest and supplied values to tiller via gRPC) I'm not sure this is something we can tackle, but feel free to hack on it if you like!

[mikeln]

Yes, the origin repository URL (or path etc) is the desire.

[mikeln]

get gives some info:

REVISION: 1
RELEASED: Mon Apr 30 08:38:39 2018
CHART: prometheus-operator-0.0.19
USER-SUPPLIED VALUES:
{}

COMPUTED VALUES:
<source chart yamls etc>

A new meta data field would be needed....

[mikeln]

Seems like probably adding to hapi/release/release.proto or maybe hapi/release/info.proto

[slayerjain]

+1 This would be very helpful!

[nehagup]

Facing the same issue! Tried helm status, helm list, helm get.

Would love to contribute with some guidance. :)

[gpabdo]

+1 Any movement on this?

[zaro]

It's really annoying . How is one supposed to know which repo the cart came from, if he hasn't installed it ?

And even for the charts I install I need to keep track where I installed it from . Let's take nginx-ingress for example. There are 5 charts named like that on kubeapps. If I dont know which one ws used exactly, it's a lot of guesswork to find the correct one.

[bacongobbler]

1 Any movement on this?

Nobody from the community has looked into this. Please feel free to investigate the feasibility of this feature request.

[liuming-dev]

cc #6464

[Gabisonfire]

+1 This would be really helpful, for now I keep a mapping in a wiki...

[phillebaba]

Has there been any decision in how this should be implemented? I think adding a label or annotation would be a good enough solution as that seems to be the standard for how Helm tracks resources.

I can implement this is we can agree on how we should store the repository URL.

[JoshVanL]

I would like to see this feature, as it would enable version-checker to also check for Chart versions against upstream. Without this, it has no way of knowing what the latest upstream Chart version is.

I would like to see it added as a field to the Chart metadata, as ChartURL or some such. Blank if no chart repo was used.

[bacongobbler]

(copying from #8976 (comment))

A Helm chart is not tied to any remote location. It is entirely possible to take a public chart and copy it into a local location as part of security practices. Some companies do that. Some companies have long kept local copies of packages (like debian and yum ones).

In fact, you can install a release from a chart in one location and upgrade the release from a chart in another location (e.g. a fork).

The sources is something you can find in the Chart.yaml file in a chart. It points to application and/or chart source code.

helm/pkg/chart/metadata.go

Lines 34 to 35 in d675b9c

	// Source is the URL to the source code of this chart
	Sources []string `json:"sources,omitempty"`

If the chart maintainer populates this field, it can be fetched with helm show chart.

[rjbez17]

(copying from #8976 (comment))

A Helm chart is not tied to any remote location. It is entirely possible to take a public chart and copy it into a local location as part of security practices. Some companies do that. Some companies have long kept local copies of packages (like debian and yum ones).

In fact, you can install a release from a chart in one location and upgrade the release from a chart in another location (e.g. a fork).

The sources is something you can find in the Chart.yaml file in a chart. It points to application and/or chart source code.

helm/pkg/chart/metadata.go

Lines 34 to 35 in d675b9c

	// Source is the URL to the source code of this chart
	Sources []string `json:"sources,omitempty"`

If the chart maintainer populates this field, it can be fetched with helm show chart.

@bacongobbler I think this is the exact reason it is worthwhile to put the original repo in the release. So you can track from where it came from overtime, deteremine if a third party (or some random SRE) manually pushed changes or if it came from the desired repository. From an auditing perspective it would be greatly helpful IMO. Additionally, it'll help close the loop for auditors wanting to verify a helm chart came from an internal repository instead a remote one.

It would also have the added benefit of allowing things (i.e. pipelines, deploy tools, etc) to discover the proper repositories to use instead of passing around global based on the existing cluster.

A helm release is a point-in-time of repo/path + chart deployed into a cluster. Having the repo information is important to understanding that point in time.

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.

[bitfisher]

unstale please

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.

[jan-hudec]

unstale, please.

[DesireWithin]

Please, add chart source to the helm ls output as well

[dwgillies-bluescape]

I recommend that when helm does an installation, it saves the repo url in an annotation associated with the resources it installs. Then it will be able to easily print out this data with the helm list -A command. It could either be printed by default or with an extra argument to ask for a more detailed view. helm list -A --wide or something.

In addition, it would be great to be able to retrieve the reinstall command from the helm cli.

helm history -n namespace podname

And it could produce a command to reinstall the chart (perhaps any custom yaml could be sent in through a command line string). One use-case for this is when a terraform chart installs in failed state, I would love to be able to type something like

$ helm history -n namespace podname > helm-redo.sh
$ echo " --debug" >> helm-redo.sh
$ helm uninstall -n namespace podname
$ ./helm-redo.sh

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.

[aemaem]

The PR is marked with the next release 3.12. This would be super helpful!

[joejulian]

Think of that more as a goal. Whether it gets reviews and merged still depends on a core maintainer having the time. Nobody's paid to work on helm full-time, but as volunteers they're trying their best. 🤞

[xeberth]

You can get the repo details from an installed helm release by getting the secret for that release stored in your cluster:

1.- Get all helm related secrets from all namepsaces in your cluster with:

kubectl get secrets -A | grep -i helm

2.- Once you find the name of your helm release secret , get the secret metadata with:

kubectl get secret SECRET_NAME -o json | jq .data.release \
  | tr -d '"' | base64 -d | base64 -d | gzip -d \
  | jq '.chart.metadata'

Now you can see all the information regarding the repository used to install the release.

[ksemele]

@xeberth nope... that's not resolve issue with repoUrl...
For example, I installed nginx via that chart:
helm install akrugliak-nginx nginx-stable/nginx-ingress
And from cluster I can get only image metadata:

kubectl get secret sh.helm.release.v1.akrugliak-nginx.v1 -o json | jq .data.release \
  | tr -d '"' | base64 -d | base64 -d | gzip -d \
  | jq '.chart.metadata'
{
  "name": "nginx-ingress",
  "home": "https://github.com/nginxinc/kubernetes-ingress",
  "sources": [
    "https://github.com/nginxinc/kubernetes-ingress/tree/v3.3.1/deployments/helm-chart"
  ],
  "version": "1.0.1",
  "description": "NGINX Ingress Controller",
  "keywords": [
    "ingress",
    "nginx"
  ],
  "maintainers": [
    {
      "name": "nginxinc",
      "email": "kubernetes@nginx.com"
    }
  ],
  "icon": "https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.1/deployments/helm-chart/chart-icon.png",
  "apiVersion": "v2",
  "appVersion": "3.3.1",
  "kubeVersion": ">= 1.22.0-0",
  "type": "application"
}

Which repo I used? Nobody knows...

helm search repo nginx-ingress
NAME                                            CHART VERSION   APP VERSION                             DESCRIPTION                                       
bitnami/nginx-ingress-controller                9.9.2           1.9.3                                   NGINX Ingress Controller is an Ingress controll...
nginx-ingress/nginx-ingress                     1.0.1           3.3.1                                   NGINX Ingress Controller                          
nginx-stable/nginx-ingress                      1.0.1           3.3.1                                   NGINX Ingress Controller                          
nginx-ingress/nginx-appprotect-dos-arbitrator   0.1.0           1.1.0                                   NGINX App Protect Dos arbitrator                  
nginx-ingress/nginx-devportal                   1.7.1           1.7.1                                   A Helm chart for deploying ACM Developer Portal   
nginx-ingress/nginx-service-mesh                2.0.0                                                   NGINX Service Mesh                                
nginx-ingress/nms                               1.11.0          NIM 2.14.0|ACM 1.9.1|ADM 4.0.0-ea.3     A chart for installing the NGINX Management Suite 
nginx-ingress/nms-acm                           1.9.1           1.9.1                                   A Helm chart for Kubernetes                       
nginx-ingress/nms-adm                           4.0.0           4.0.0                                   A Helm chart for ADM                              
nginx-ingress/nms-hybrid                        2.14.0          2.14.0                                  A Helm chart for Kubernetes  

[ksemele]

How we can accelerate approve of that PR?
#11378

More than year for adding one metadata field, really, guys? :(
How commynity can help with that?

[assiakhateeb]

+1

[migs35323]

+1
Adding one more case scenario that this is needed:
rancher has several repositories, "rancher-latest" and "rancher-stable", and rancher-alpha
There is no way to know from which repo the chart comes from.
In Rancher docs as a workaround they give instructions to remove the old repo, basically "if you want to change versions, just keep1 repo at a time in your machine", but as i manage more than 1 cluster i do have both repos in my machine...

[MedAzizTousli]

+1

[ericksilvaRendimento]

+1
I need to downgrade a chart that was installed automatically by Rancher (fleet). Wasn't me.
I need to add the origin repo, to search chart versions and specify on helm command to upgrade

[NeodymiumFerBore]

+1

[zodilib]

+1

[busyboy77]

+10000