Switch Radius Helm chart pull from ACR to GHCR

pkg/cli/helm/helm.go

@@ -20,15 +20,18 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 
+	containerderrors "github.com/containerd/containerd/remotes/errors"
 	helm "helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/chart"
 	"helm.sh/helm/v3/pkg/chart/loader"
 	"helm.sh/helm/v3/pkg/cli"
+	"helm.sh/helm/v3/pkg/registry"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 )
 
@@ -79,7 +82,6 @@ func locateChartFile(dirPath string) (string, error) {
 
 func helmChartFromContainerRegistry(version string, config *helm.Configuration, repoUrl string, releaseName string) (*chart.Chart, error) {
 	pull := helm.NewPull()
-	pull.RepoURL = repoUrl
 	pull.Settings = &cli.EnvSettings{}
 	pullopt := helm.WithConfig(config)
 	pullopt(pull)
@@ -101,8 +103,42 @@ func helmChartFromContainerRegistry(version string, config *helm.Configuration,
 
 	pull.DestDir = dir
 
-	_, err = pull.Run(releaseName)
+	var chartRef string
+
+	if !registry.IsOCI(repoUrl) {
+		// For non-OCI registries (like contour), we need to set the repo URL
+		// to the registry URL. The chartRef is the release name.
+		// ex.
+		// pull.RepoURL = https://charts.bitnami.com/bitnami
+		// pull.Run("contour")
+		pull.RepoURL = repoUrl
+		chartRef = releaseName
+	} else {
+		// For OCI registries (like radius), we will use the
+		// repo URL + the releaseName as the chartRef.
+		// pull.Run("oci://ghcr.io/radius-project/helm-chart/radius")
+		chartRef = fmt.Sprintf("%s/%s", repoUrl, releaseName)
+
+		// Since we are using an OCI registry, we need to set the registry client
+		registryClient, err := registry.NewClient()
+		if err != nil {
+			return nil, err
+		}
+
+		pull.SetRegistryClient(registryClient)
+	}
+
+	_, err = pull.Run(chartRef)
 	if err != nil {
+		// Error handling for a specific case where credentials are stale.
+		// This happens for ghcr in particular because ghcr does not use
+		// subdomains - the scope of a login is all of ghcr.io.
+		// https://github.com/helm/helm/issues/12584
+		err := extractHelmError(err)
+		if err != nil {
+			return nil, err
+		}
+
 		return nil, fmt.Errorf("error downloading helm chart from the registry for version: %s, release name: %s. Error: %w", version, releaseName, err)
 	}
 
@@ -136,3 +172,17 @@ func runUpgrade(upgradeClient *helm.Upgrade, releaseName string, helmChart *char
 	}
 	return err
 }
+
+// extractHelmError is a helper function to extract a specific error
+// (403 unauthorized when downloading a helm chart from ghcr.io) from a chain of errors.
+// If the error is not found, it returns nil.
+func extractHelmError(err error) error {
+	var errUnexpectedStatus containerderrors.ErrUnexpectedStatus
+	if errors.As(err, &errUnexpectedStatus) {
+		if errUnexpectedStatus.StatusCode == http.StatusForbidden && strings.Contains(errUnexpectedStatus.RequestURL, "ghcr.io") {
+			return fmt.Errorf("recieved 403 unauthorized when downloading helm chart from the registry. you may want to perform a `docker logout ghcr.io` and re-try the command")
+		}
+	}
+
+	return nil
+}

pkg/cli/helm/helm_test.go

@@ -0,0 +1,33 @@
+package helm
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"testing"
+
+	containerderrors "github.com/containerd/containerd/remotes/errors"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestExtractHelmError(t *testing.T) {
+	err := errors.New("error")
+	extractedErr := extractHelmError(err)
+	assert.Nil(t, extractedErr)
+
+	err = fmt.Errorf("%w: wrapped error", errors.New("error"))
+	extractedErr = extractHelmError(err)
+	assert.Nil(t, extractedErr)
+
+	err = fmt.Errorf("%w: wrapped error", containerderrors.ErrUnexpectedStatus{})
+	extractedErr = extractHelmError(err)
+	assert.Nil(t, extractedErr)
+
+	err = fmt.Errorf("%w: wrapped error", containerderrors.ErrUnexpectedStatus{StatusCode: http.StatusForbidden, RequestURL: "ghcr.io/myregistry"})
+	extractedErr = extractHelmError(err)
+	assert.Equal(t, errors.New("recieved 403 unauthorized when downloading helm chart from the registry. you may want to perform a `docker logout ghcr.io` and re-try the command"), extractedErr)
+
+	err = containerderrors.ErrUnexpectedStatus{StatusCode: http.StatusForbidden, RequestURL: "ghcr.io/myregistry"}
+	extractedErr = extractHelmError(err)
+	assert.Equal(t, errors.New("recieved 403 unauthorized when downloading helm chart from the registry. you may want to perform a `docker logout ghcr.io` and re-try the command"), extractedErr)
+}

pkg/cli/helm/radiusclient.go

@@ -36,7 +36,7 @@ import (
 
 const (
 	radiusReleaseName     = "radius"
-	radiusHelmRepo        = "https://radius.azurecr.io/helm/v1/repo"
+	radiusHelmRepo        = "oci://ghcr.io/radius-project/helm-chart"
 	RadiusSystemNamespace = "radius-system"
 )