can't install chart using user:password@repo

[nimrodishi]

Hey, I'm using K3S with the HelmChart resource.
It doesn't support a dedicated user/password fields - instead I use https://:@my-piravte-erpo
It failed, so I tried to reproduce directly with helm.

running the command:
helm install --namespace default --repo https://<user>:>password>@<repo> <name> <chart>
also fails. It successfully grabs the index.yaml file, but fails to get the .tgz file. in the error message, it states:
Error: failed to fetch https://<repo>/<chart>-0.1.1.tgz : 204 No Content
It doesn't use username or password - I check the repo logs and it does show a request from me (for index.yaml) followed by anonymous request (for the .tgz).

When working manually I can use repo add and update before, or just pass the username/password flags, but I think this is a bug as Id expect helm to reuse these values.

Ill also open a ticket on the HelmController that k3s uses to run these - if they can add a username/password fields this will also solve.

Thanks a lot!!

Output of helm version:
version.BuildInfo{Version:"v3.5.4", GitCommit:"1b5edb69df3d3a08df77c9902dc17af864ff05d1", GitTreeState:"clean", GoVersion:"go1.15.11"}
Output of kubectl version:
Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.7+k3s1", GitCommit:"aa768cbdabdb44c95c5c1d9562ea7f5ded073bc0", GitTreeState:"clean", BuildDate:"2021-05-20T01:07:13Z", GoVersion:"go1.15.12", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.7+k3s1", GitCommit:"aa768cbdabdb44c95c5c1d9562ea7f5ded073bc0", GitTreeState:"clean", BuildDate:"2021-05-20T01:07:13Z", GoVersion:"go1.15.12", Compiler:"gc", Platform:"linux/amd64"}
Cloud Provider/Platform (AKS, GKE, Minikube etc.):
rancher K3S

[cndoit18]

I think this is a similar problem to #9599, if -username and -password are not specified. I think using the username and password carried in the URL is a better option (instead of going to search from local)
WDYT @bacongobbler

[mattfarina]

First, the HelmChart resource is part of k3s and not part of Kubernetes itself. It's an add-on the distribution is providing. For issues with that please contact the k3s project.

The issue here is related to #9599 but is slightly different. If there is a username and password in the URL it would need to be pulled out of the URL and passed around. A new change would be needed to fix this.

Putting the username and password in the URL isn't usually a good idea. There are places where Helm displays the URL and the username and password would then be displayed. So, this is discouraged in general. We don't want to accidentally log credentials, for example.

[bacongobbler]

relevant security issue: #9777

[bacongobbler]

Please use helm install --repo --username. The CLI will prompt for your password. To pass username/password to the chart URL, pass the --pass-credentials flag introduced in Helm 3.6.1. Thanks!