Push to OCI insecure registry #10408

pytimer · 2021-11-29T09:20:42Z

What this PR does / why we need it:

This PR implement push chart to OCI registry, or pull chart from OCI registry.

Usage:

# push
$ ./bin/helm push consul-3.9.5.tgz oci://docker.registry:30001/library --insecure-skip-tls-verify 

# pull
$ ./bin/helm pull oci://docker.registry:30001/library/consul --version 3.9.5 --insecure-skip-tls-verify

# install
$ ./bin/helm install consul oci://docker.registry:30001/library/consul --version 3.9.5 --insecure-skip-tls-verify

# upgrade
$ ./bin/helm upgrade --install consul oci://docker.registry:30001/library/consul --version 3.9.6 --insecure-skip-tls-verify

Special notes for your reviewer:

If applicable:

this PR contains documentation
this PR contains unit tests
this PR has been tested for backwards compatibility

pytimer · 2022-01-14T09:34:05Z

Need to update this pr code, because oci feature move out experimental. related pr: #10546

pytimer · 2022-01-18T02:03:07Z

Update push/pull chart to oci insecure registry from the latest code, because oci feature move out experimental.

jdolitsky · 2022-02-08T20:53:21Z

cmd/helm/push.go

@@ -54,5 +54,9 @@ func newPushCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 		},
 	}

+	f := cmd.Flags()
+	f.BoolVar(&client.InsecureSkipTLSverify, "insecure-skip-tls-verify", false, "skip tls certificate checks for the chart upload")


~~Should this just be --insecure ?~~

Nvm, looks like this is same flag we use for helm repo commands

I see the helm pull use insecure-skip-tls-verify, so i add this flag in helm push, should i change it?

no, lets keep like this

jdolitsky · 2022-02-09T15:30:36Z

pkg/action/pull.go

+	if p.InsecureSkipTLSverify || p.PlainHTTP {
+		if err := p.cfg.RegistryClient.WithResolver(p.InsecureSkipTLSverify, p.PlainHTTP); err != nil {
+			return out.String(), err
+		}
+	}


@pytimer - can we also make sure this is used in helm install / helm upgrade?

See #10659 (comment)

I missing it, i will try it tomorrow.

I see the helm install/upgrade code, now --insecure-skip-tls-verify not used in install/upgrade command when scheme is oci://.
I can do it in helm install/upgrade to support insecure OCI registry, but i'm not sure that in this pr or open another pr to do it.

if you have the bandwidth to add to install/upgrade, please do!

arukiidou · 2022-02-11T15:44:47Z

it worked with self-signed ssl!

Push

> helm push traefik-10.14.1.tgz oci://[gitlab]:5005/arukiidou/grype --insecure-skip-tls-verify
Pushed: [gitlab]:5005/arukiidou/grype/traefik:10.14.1
Digest: sha256:2b9166854adf09d2aa0d24dd166431539e369caa94bb57750bd87f195917a248

> helm push traefik-10.14.1.tgz oci://[gitlab]:5005/arukiidou/grype
Error: failed to do request: Head "https://[gitlab]:5005/v2/arukiidou/grype/traefik/blobs/sha256:32fd640f11acced4fdb4d13866394e2a94a0085de340b59b807f9a95cbfb1f9b": x509: certificate signed by unknown authority

pull

> helm pull oci://[gitlab]:5005/arukiidou/grype/traefik   --insecure-skip-tls-verify
Pulled: [gitlab]:5005/arukiidou/grype/traefik:10.14.1
Digest: sha256:2b9166854adf09d2aa0d24dd166431539e369caa94bb57750bd87f195917a248

> helm pull oci://[gitlab]:5005/arukiidou/grype/traefik
Error: Get "https://[gitlab]:5005/v2/arukiidou/grype/traefik/tags/list": x509: certificate signed by unknown authority

geowalrus4gh · 2022-02-14T07:56:04Z

Waiting for this fix to implement OCI based image and helm repository using Harbor.

pytimer · 2022-02-17T05:58:44Z

I will commit helm install/upgrade code when use insecure OCI registry or self-certificate registry on the next week, there are some problems with the code need to be update in my local develop branch.

pytimer · 2022-02-25T09:45:11Z

Now this pr supports helm install/upgrade/pull/push with self-signed certificate OCI registry.

@jdolitsky please review the code if you have time, thanks.

jdolitsky · 2022-02-25T21:50:20Z

@pytimer - can you please fix the DCO error?

jdolitsky · 2022-02-25T21:56:05Z

I believe this is in conflict with #10638 ...

@antgamdia - once @pytimer fixes DCO, would you be able to push on top of this PR/fork? I think ClientOptResolver if preferable over the WithResolver proposed here.

@pytimer - let us know if this sounds OK to you

pytimer · 2022-02-25T23:18:41Z

@pytimer - can you please fix the DCO error?

I will fix it today.

pytimer · 2022-02-25T23:24:25Z

@antgamdia - once @pytimer fixes DCO, would you be able to push on top of this PR/fork? I think ClientOptResolver if preferable over the WithResolver proposed here.

OK. If need me to do anything, please tell me, thanks.

Signed-off-by: pytimer <lixin20101023@gmail.com>

antgamdia · 2022-02-26T09:58:22Z

.antgamdia - once .pytimer fixes DCO, would you be able to push on top of this PR/fork? I think ClientOptResolver if preferable over the WithResolver proposed here.

Sure! Will do during next week

dreamerkr · 2022-12-30T02:38:11Z

3.10.3 version， helm push not find -insecure-skip-tls-verify

sabre1041 · 2022-12-30T02:46:43Z

@dreamerkr this PR was not merged yet so it did not make it into the 3.10 release

dreamerkr · 2022-12-30T02:59:28Z

@dreamerkr this PR was not merged yet so it did not make it into the 3.10 release

now，How to solve this problem? the best solution use https? but I only want try it

sabre1041 · 2022-12-30T03:14:09Z

@dreamerkr currently, yes only an HTTPS expository is supported. As mentioned, there are ongoing efforts to bring the plain HTTP based integrations

ashrayjain · 2023-01-10T23:52:07Z

Can we get a release with this PR merged please?

dixudx · 2023-02-02T02:59:13Z

Could we get this feature merged? It has been here for a long time. We need this feature. Thanks.

beaniebag · 2023-04-20T11:46:54Z

Tested v3.11.3
helm registry works with --insecure
helm push/pull works with --insecure-skip-tls-verify

willzhang · 2023-04-20T18:09:45Z

Tested v3.11.3 helm registry works with --insecure helm push/pull works with --insecure-skip-tls-verify

still not work in v3.11.3

root@ubuntu:~# helm version
version.BuildInfo{Version:"v3.11.3", GitCommit:"323249351482b3bbfc9f5004f65d400aa70f9ae7", GitTreeState:"clean", GoVersion:"go1.20.3"}

login

root@ubuntu:~# helm registry login --insecure sealos.hub:5000 -u admin -p passw0rd 
WARNING: Using --password via the CLI is insecure. Use --password-stdin.
INFO[0000] Error logging in to endpoint, trying next endpoint  error="Get \"https://sealos.hub:5000/v2/\": http: server gave HTTP response to HTTPS client"
Login Succeeded
root@ubuntu:~# 
root@ubuntu:~# 
root@ubuntu:~# helm push nginx-13.2.34.tgz oci://sealos.hub:5000/library --insecure-skip-tls-verify
Error: failed to do request: Head "https://sealos.hub:5000/v2/library/nginx/blobs/sha256:d5f440f331d6ce10a5af6c0ce82633dc49217b8f04531d5a27143ff51afe07a2": http: server gave HTTP response to HTTPS client
root@ubuntu:~#

beaniebag · 2023-04-21T00:07:31Z

Tested v3.11.3 helm registry works with --insecure helm push/pull works with --insecure-skip-tls-verify

still not work in v3.11.3

root@ubuntu:~# helm version
version.BuildInfo{Version:"v3.11.3", GitCommit:"323249351482b3bbfc9f5004f65d400aa70f9ae7", GitTreeState:"clean", GoVersion:"go1.20.3"}

login

root@ubuntu:~# helm registry login --insecure sealos.hub:5000 -u admin -p passw0rd 
WARNING: Using --password via the CLI is insecure. Use --password-stdin.
INFO[0000] Error logging in to endpoint, trying next endpoint  error="Get \"https://sealos.hub:5000/v2/\": http: server gave HTTP response to HTTPS client"
Login Succeeded
root@ubuntu:~# 
root@ubuntu:~# 
root@ubuntu:~# helm push nginx-13.2.34.tgz oci://sealos.hub:5000/library --insecure-skip-tls-verify
Error: failed to do request: Head "https://sealos.hub:5000/v2/library/nginx/blobs/sha256:d5f440f331d6ce10a5af6c0ce82633dc49217b8f04531d5a27143ff51afe07a2": http: server gave HTTP response to HTTPS client
root@ubuntu:~#

Ah, yep you're correct. I confused this with a server using a self-signed certificate

cyxinda · 2023-06-07T03:17:22Z

root@ubuntu:/home/cyxinda/workspace/test# helm version
version.BuildInfo{Version:"v3.12.0", GitCommit:"c9f554d75773799f72ceef38c51210f1842a1dea", GitTreeState:"clean", GoVersion:"go1.20.3"}
root@ubuntu:/home/cyxinda/workspace# helm push test-0.1.0.tgz oci://harbor.192.168.5.6.nip.io/my --ca-file /etc/containerd/certs.d/harbor.192.168.5.6.nip.io/ca.crt --cert-file  /etc/containerd/certs.d/harbor.192.168.5.6.nip.io/harbor.192.168.5.6.nip.io.cert --key-file  /etc/containerd/certs.d/harbor.192.168.5.6.nip.io/harbor.192.168.5.6.nip.io.key
Pushed: harbor.192.168.5.6.nip.io/my/test:0.1.0
Digest: sha256:15244ea1d01d8d7f4617252687c8c143ef543d61c9e13657ef30139258b8944d

root@ubuntu:/home/cyxinda/workspace/test# helm pull oci://harbor.192.168.5.6.nip.io/my/test --version 0.1.0 --ca-file /etc/containerd/certs.d/harbor.192.168.5.6.nip.io/ca.crt --cert-file  /etc/containerd/certs.d/harbor.192.168.5.6.nip.io/harbor.192.168.5.6.nip.io.cert --key-file  /etc/containerd/certs.d/harbor.192.168.5.6.nip.io/harbor.192.168.5.6.nip.io.key
Pulled: harbor.192.168.5.6.nip.io/my/test:0.1.0
Digest: sha256:15244ea1d01d8d7f4617252687c8c143ef543d61c9e13657ef30139258b8944d
root@ubuntu:/home/cyxinda/workspace/test# ls
test-0.1.0.tgz

joejulian · 2023-08-09T00:27:18Z

@pytimer Can you please rebase?

BesartSulejmani · 2023-11-22T12:27:43Z

When will this be merged? We actually need this badly.

sabre1041 · 2023-11-27T07:13:41Z

@BesartSulejmani Capabilities should now be available

#12128

We should be good to close this PR as I believe that everything has been covered? @mattfarina @joejulian @gjenkins8

joejulian · 2024-09-12T15:47:00Z

We should be good to close this PR as I believe that everything has been covered

I agree. Closing

helm-bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Nov 29, 2021

pytimer mentioned this pull request Nov 29, 2021

How can I push chart to an insecure OCI registry with helm v3 #6324

Closed

pytimer force-pushed the push-registry branch from 8e315df to 3e0a755 Compare November 29, 2021 09:27

pytimer changed the title ~~WIP: Add push to OCI registry~~ WIP: Push to OCI registry Nov 30, 2021

pytimer force-pushed the push-registry branch from 3e0a755 to f7ebbe7 Compare November 30, 2021 02:49

pytimer mentioned this pull request Nov 30, 2021

Moving OCI integration from experimental to full feature #10393

Closed

6 tasks

pytimer changed the title ~~WIP: Push to OCI registry~~ Push to OCI registry Nov 30, 2021

scottrigby added the bug Categorizes issue or PR as related to a bug. label Jan 13, 2022

scottrigby added this to the 3.8.1 milestone Jan 13, 2022

pytimer force-pushed the push-registry branch from f7ebbe7 to 3660bf8 Compare January 18, 2022 02:00

pytimer changed the title ~~Push to OCI registry~~ Push to OCI insecure registry Jan 18, 2022

jdolitsky mentioned this pull request Feb 8, 2022

Cannot push to HTTPS registry with self-signed certificate #10659

Closed

jdolitsky approved these changes Feb 8, 2022

View reviewed changes

jdolitsky reviewed Feb 8, 2022

View reviewed changes

jdolitsky suggested changes Feb 9, 2022

View reviewed changes

pytimer added 2 commits February 26, 2022 07:30

Push to insecure OCI registry

6cb1478

Signed-off-by: pytimer <lixin20101023@gmail.com>

Install or upgrade supports OCI insecure registry

2f861d4

Signed-off-by: pytimer <lixin20101023@gmail.com>

pytimer force-pushed the push-registry branch from a500a9b to 2f861d4 Compare February 25, 2022 23:31

antgamdia mentioned this pull request Mar 4, 2022

Allow setting a resolver in the OCI registry client #10638

Closed

3 tasks

mattfarina modified the milestones: 3.11.0, 3.12.0, 3.11.1 Jan 18, 2023

yxxhero modified the milestones: 3.11.1, 3.12.0 Feb 2, 2023

joejulian modified the milestones: 3.12.0, 3.13.0 May 5, 2023

joejulian added the oci Related to Helm OCI feature label May 9, 2023

willzhang mentioned this pull request Jun 21, 2023

Feature: Support push helm charts to private registry labring/sealos#1488

Closed

joejulian added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. Has One Approval This PR has one approval. It still needs a second approval to be merged. and removed awaiting review labels Aug 1, 2023

joejulian removed this from the 3.13.0 milestone Aug 11, 2023

joejulian added the Stale label Aug 25, 2023

joejulian closed this Sep 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Push to OCI insecure registry #10408

Push to OCI insecure registry #10408

pytimer commented Nov 29, 2021 •

edited

Loading

pytimer commented Jan 14, 2022

pytimer commented Jan 18, 2022

jdolitsky Feb 8, 2022 •

edited

Loading

pytimer Feb 10, 2022

jdolitsky Feb 10, 2022

jdolitsky Feb 9, 2022

pytimer Feb 10, 2022

pytimer Feb 10, 2022

jdolitsky Feb 10, 2022 •

edited

Loading

arukiidou commented Feb 11, 2022 •

edited

Loading

geowalrus4gh commented Feb 14, 2022

pytimer commented Feb 17, 2022

pytimer commented Feb 25, 2022

jdolitsky commented Feb 25, 2022

jdolitsky commented Feb 25, 2022

pytimer commented Feb 25, 2022

pytimer commented Feb 25, 2022

antgamdia commented Feb 26, 2022

dreamerkr commented Dec 30, 2022

sabre1041 commented Dec 30, 2022

dreamerkr commented Dec 30, 2022

sabre1041 commented Dec 30, 2022

ashrayjain commented Jan 10, 2023

dixudx commented Feb 2, 2023

beaniebag commented Apr 20, 2023

willzhang commented Apr 20, 2023

beaniebag commented Apr 21, 2023

cyxinda commented Jun 7, 2023

joejulian commented Aug 9, 2023

BesartSulejmani commented Nov 22, 2023

sabre1041 commented Nov 27, 2023

joejulian commented Sep 12, 2024

Push to OCI insecure registry #10408

Push to OCI insecure registry #10408

Conversation

pytimer commented Nov 29, 2021 • edited Loading

pytimer commented Jan 14, 2022

pytimer commented Jan 18, 2022

jdolitsky Feb 8, 2022 • edited Loading

Choose a reason for hiding this comment

pytimer Feb 10, 2022

Choose a reason for hiding this comment

jdolitsky Feb 10, 2022

Choose a reason for hiding this comment

jdolitsky Feb 9, 2022

Choose a reason for hiding this comment

pytimer Feb 10, 2022

Choose a reason for hiding this comment

pytimer Feb 10, 2022

Choose a reason for hiding this comment

jdolitsky Feb 10, 2022 • edited Loading

Choose a reason for hiding this comment

arukiidou commented Feb 11, 2022 • edited Loading

Push

pull

geowalrus4gh commented Feb 14, 2022

pytimer commented Feb 17, 2022

pytimer commented Feb 25, 2022

jdolitsky commented Feb 25, 2022

jdolitsky commented Feb 25, 2022

pytimer commented Feb 25, 2022

pytimer commented Feb 25, 2022

antgamdia commented Feb 26, 2022

dreamerkr commented Dec 30, 2022

sabre1041 commented Dec 30, 2022

dreamerkr commented Dec 30, 2022

sabre1041 commented Dec 30, 2022

ashrayjain commented Jan 10, 2023

dixudx commented Feb 2, 2023

beaniebag commented Apr 20, 2023

willzhang commented Apr 20, 2023

beaniebag commented Apr 21, 2023

cyxinda commented Jun 7, 2023

joejulian commented Aug 9, 2023

BesartSulejmani commented Nov 22, 2023

sabre1041 commented Nov 27, 2023

joejulian commented Sep 12, 2024

pytimer commented Nov 29, 2021 •

edited

Loading

jdolitsky Feb 8, 2022 •

edited

Loading

jdolitsky Feb 10, 2022 •

edited

Loading

arukiidou commented Feb 11, 2022 •

edited

Loading