Support for OCI helm Repositories

[roitalpaz]

Problem description

pulumi does not support using Helm chart and OCI registries with the experimental OCI support.
According to https://helm.sh/docs/topics/registries/

AWS documented the above here:
https://docs.aws.amazon.com/AmazonECR/latest/userguide/push-oci-artifact.html

[roitalpaz]

The current workaround, download Helm chart using AWS API.

import * as pulumi from "@pulumi/pulumi";
import {ECRClient, BatchGetImageCommand, GetDownloadUrlForLayerCommand} from "@aws-sdk/client-ecr";
import * as download from "download";

// Download and extract the `latest` helm chart into folder
export const downloadHelm = async (repoName: string, downloadDestination: string, region: string) => {
    const stampEcrClient = new ECRClient({
            region: region,
        }
    );

    const getImageCommand = new BatchGetImageCommand({
        repositoryName: repoName,
        imageIds: [{imageTag: "latest"}]
    })

    try {
        const getImagesResponse = await stampEcrClient.send(getImageCommand);
        await pulumi.log.debug(`Got ${getImagesResponse.$metadata}`)

        if (getImagesResponse.images && getImagesResponse.images.length > 0 && getImagesResponse.images[0].imageManifest) {
            if (getImagesResponse.images.length > 1) {
                await pulumi.log.error(`Got too many results. ${getImagesResponse.images.length}`)
                new pulumi.RunError(`Got too many results. ${getImagesResponse.images.length}`)
            }

            const imageManifest = JSON.parse(getImagesResponse.images[0].imageManifest)

            const getDownloadURL = new GetDownloadUrlForLayerCommand({
                repositoryName: repoName,
                layerDigest: imageManifest.layers[0].digest,
            })
            const downloadURLResponse = await stampEcrClient.send(getDownloadURL);
            if (downloadURLResponse.downloadUrl) {
                await download(downloadURLResponse.downloadUrl, downloadDestination, {extract: true});
            }

        } else {
            await pulumi.log.error(`Got no Images: ${JSON.stringify(getImagesResponse.failures)}.`)
            new pulumi.RunError("Error getting images")
        }
    } catch (error) {
        await pulumi.log.error(`Error occurred: ${JSON.stringify(error)}.`)
        new pulumi.RunError(error)
    }
}

[yuft]

Does anyone have a workaround for Azure Container Registry?
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-helm-repos

[lblackstone]

I think we should be able to support this in the new helm.Release resource. I haven't tested it yet, but it's possible that it would work just by setting the env var (HELM_EXPERIMENTAL_OCI=1) and running that resource. If not, it should be straightforward to plumb that option through.

FYI @viveklak

[lblackstone]

I checked if setting the HELM_EXPERIMENTAL_OCI env var would work, and it doesn't appear so. It looks like we'll need to add a handler specifically for OCI repos in the client, and then create an input type to support the configuration in the SDK.

OCI support is still experimental and subject to breaking changes, but it's probably ok since we're pinning to a specific client version in the provider. The internal implementation shouldn't affect user programs as long as we can maintain the same API.

[lblackstone]

I ran into some problems trying to implement this because the required OCI client packages are still experimental:
helm/helm#9188
helm/helm#10393

It looks like the packages may be available to use externally sometime soon:
helm/helm#10447

Since the upstream work is ongoing, I don't think we should directly support this feature yet. We'll keep an eye on the upstream progress, and reevaluate if it looks like it's stalled.

In the meantime, I'd suggest working around by downloading the chart separately and then referencing the local chart path.

Edit: Here's my WIP code for this: #1835

[SharpEdgeMarshall]

With helm 3.8.x now the OCI standard is out of beta so this issue should be reconsidered

[lblackstone]

With helm 3.8.x now the OCI standard is out of beta so this issue should be reconsidered

Thanks for the heads up! We'll give this another look.