Use HELM behind proxy: support insecure repositories when charts get downloaded

[ghost]

Version info

Output of helm version: v3 canary build 4/4/2020
Output of kubectl version: 1.16.2
Cloud Provider/Platform (AKS, GKE, Minikube etc.): Minishift

---

Context

Recently support for insecure registries has been added:

• Initial ticket: Need support for --insecure-skip-tls-verify #5434
• Pull request: Add --insecure-skip-tls-verify for repositories #7254

Although adding the insecure registries works perfectly, we cannot pull/install/upgrade images due to TLS verification still being done.

Configuration:

Helm 'repositories.yaml' configuration:

apiVersion: ""
generated: "0001-01-01T00:00:00Z"
repositories:
- caFile: ""
  certFile: ""
  insecure_skip_tls_verify: true
  keyFile: ""
  name: fluxcd
  password: ""
  url: https://<helm-repository>/repository/helm-fluxcd/
  username: ""

Problem

When pulling the chart we get following error:

bamboo@app-bamboo-agent-5:~$ helm pull fluxcd/flux
Error: Get https://<helm-repository>/repository/helm-fluxcd/flux-1.3.0.tgz: x509: certificate signed by unknown authority

Just making sure by specyfing the repo directly:

bamboo@app-bamboo-agent-5:~$ helm pull fluxcd/flux --repo https://repo.crelan-int.be/repository/helm-fluxcd/
Error: looks like "https://<helm-repository>/repository/helm-fluxcd/" is not a valid chart repository or cannot be reached: Get https://<helm-repository>/repository/helm-fluxcd/index.yaml: x509: certificate signed by unknown authority

Fix

Current pull, install and upgrade commands should keep into account that TLS verification is not required if the repository is marked as insecure.

[xvzf]

/assign xvzf

[technosophos]

It looks like @xvzf has self-assigned! Thanks! I have added the bug label. Let me know if you feel that this is more of a feature request.

[xvzf]

Why this is a draft: Seems like it breaks something with the Kubernetes cluster configuration and I don't know why yet 😞

 ! [lola ~/p/helm] git:(fix_insecure_skip_verify) ✗ go run ./cmd/helm install --insecure-skip-tls-verify test fluxcd/flux
Error: Kubernetes cluster unreachable: Get "https://kubernetes.docker.internal:6443/version?timeout=32s": x509: certificate signed by unknown authority
exit status 1

[xvzf]

Nvm, mitmproxy also proxies the k8s apiserver, PR is done

[paulczar]

It looks like this is resolved, there may still be an issue with helm accessing an insecure k8s cluster, but the repo/charts are good. Feel free to open a new issue if we need to resolve the latter.

[xvzf]

@paulczar issue is closed by a still open PR - I suggest to keep this open for tracking!

[bacongobbler]

merged #8039 just now, so we should be good here.