How do you mirror Helm registries?

[AndersBennedsgaard]

Hello. I am trying to set up mirroring of an internal Helm repository, but I haven't been successful at it. helm keeps complaining for multiple different reasons, such as unexpected status code 404: name unknown: repository name not known to registry. Just to keep it simple, I tried public repositories at first, and I wasn't successful with that either.
I've tried multiple different ways. Two examples are:

extensions:
  sync:
    enable: true
    registries:
      - urls:
        - https://ghcr.io
        onDemand: true
        onlySigned: false
        content:
          - prefix: "**"
            destination: /helm-charts
      - urls:
        - https://ghcr.io/grafana/helm-charts/
        onDemand: true
        onlySigned: false
        content:
          - prefix: "**"
            destination: /grafana-charts

Helm command I believe should work (I've exposed Zot at port 8080): helm pull oci://localhost:8080/grafana-charts/grafana:8.0.2 --plain-http

So, what am I doing wrong? I am sure it is just a dumb oversight by me, but I just can't figure it out :(

[rchincha]

https://github.com/project-zot/zot/blob/main/examples/config-popular-registries.json

^ @AndersBennedsgaard, we have compiled all well-known registries here. This is part of our CI, so would compare against this.

[rchincha]

If not, pls post anonymized parts of your logs (likely showing failures)

[AndersBennedsgaard]

I thought that you could use commands like helm pull --plain-http oci://localhost:8080/grafana-charts/grafana:8.0.2 to specify which chart version you wanted to use, but that is not supported. You have to set the version with --version 8.0.2 instead..

A working configuration for me looks like:

extensions:
  sync:
    enable: true
    credentialsFile: /credentials/credentials.json
    registries:
      # expose ghcr.io/<org>/<repository> under <zot-url>/<org>/<repository>
      - urls:
        - https://ghcr.io
        onDemand: true
        tlsVerify: true
        onlySigned: false
        content:
          - prefix: <org>/<repository>/**

      # expose ghcr.io/<org>/<repository> under <zot-url>/<repository>
      - urls:
        - https://ghcr.io
        onDemand: true
        tlsVerify: true
        onlySigned: false
        content:
          - prefix: <org>/<repository>/**
            destination: <repository>
            stripPrefix: true

      # expose all ghcr.io/ under <zot-url>/ghcr.io/<org>/<repo>
      - urls:
        - https://ghcr.io
        onDemand: true
        tlsVerify: true
        onlySigned: false
        content:
          - prefix: "**"
            destination: ghcr.io

With this I was successful at pulling using Helm with something like: helm pull --plain-http oci://localhost:8080/ghcr.io/grafana/helm-charts/grafana --version 8.0.2

Two notes:

• I could not get onlySigned to work, even though all of our charts signed using something like helm package --sign ....
  This is probably related to a couple of server warnings about [...] unknown media type: application/vnd.cncf.helm.config.v1+json, [...] unknown media type: application/vnd.cncf.helm.chart.provenance.v1.prov, and [...] unknown media type: application/vnd.cncf.helm.chart.content.v1.tar+gzip
• It seems that the first pull of a chart has to have the version specified, since Zot doesn't default to the upstream latest tag.
  So I had to run helm pull --plain-http oci://localhost:8080/ghcr.io/grafana/helm-charts/grafana --version 8.0.2 before I could run helm pull --plain-http oci://localhost:8080/ghcr.io/grafana/helm-charts/grafana to get the latest tag