ArgoCD is not using helm repository credentials for Chart dependencies #7104
Comments
|
Hello @abhinavkhanna-sf, Looks like https://raw.githubusercontent.com/org/helm-charts/main/docs is indeed a not valid helm repository. Argo CD expects |
|
@alexmt we dont specify index.yaml in the chart url snippet from error above index.yaml was automatically added by helm commands. It works without index.yaml in 2.0.5 |
|
You can get 404 Not Found back from GitHub when you are trying to access private GitHub Repos without credentials. |
|
Same here. Rollbacked argocd 2.1 because of private repo access issue. |
alexmt
added
the
regression
ib-ak
changed the title
|
+1 |
1 similar comment
|
+1 |
|
In case anyone is running into this issue or is debugging the code to figure out what is wrong I found that when using any unconventional helm repo (i.e. using tested with |
|
I found a workaround that works for me, but may not be okay for everyone. I tested this in |
|
I am unable to reproduce this issue in the latest version. Added a private helm chart as a dependency and the |
|
Tested on latest (works on our current version |
|
@chetan-rns i can add a chart directly, but if i have a chart.yaml in a git repo that points to another private chart repo it wont work note we are using azure acr as our registry. the new passCredentials argument dont fix it, still 401 |
|
Maybe I'm missing something. Followed the below steps but couldn't reproduce the issue
|
|
@chetan-rns tried with argocd 2.2.2 but still same problem. I am unsure how i can debug this in our environment. but |
|
Was facing the same issues when I've upgraded ArgoCD from v2.0.5 to v.2.1.8. But I was able to fix it (thanks to @moustafab comment above) if I had included the Helm repository (Artifactory) in the
Both scenarios are working fine. |
|
Broken for me in 2.2.3 (upgraded from 2.0.3). Our projects already have sourceRepos set to 0. Context is we are using GitHub to host a private subchart that's referenced in a private repository (also on GitHub) |
Can confirm was able to resolve this issue by adding the asterisk for |
|
This seems to work for us 🎉 with kind: Secret
apiVersion: v1
type: Opaque
metadata:
name: repo-myacrrepositoryhelm
labels:
argocd.argoproj.io/secret-type: repository
data:
enableOCI: false # disable OCI explicitly
name: acrmyacrrepository
type: helm
url: https://acrmyacrrepository.azurecr.io/helm/v1/repo # Remove trailing slash
password: complexpassword
username: 1137a517-fb0a-42d2-8cd2-727fc6684c26Link #7121 |
|
Update: if you get problems with |
|
Hello , this bug is quite blocking us to upgrade. we also had to rollback to a previous version. Is there something we can do to help you fixing that soon? Thanks |
can you share more details |
any update? |
|
Managed to get it working on |
|
Verified bug is present in ArgoCD 2.3.1 and 2.3.3. I noticed a lot of remarks on #7858 after closing so this might impact more people. |
|
This issue is a very big concern for me as well. I have the issue in the latest 2.3.x version (2.3.4) and also tried the Release Candidate of 2.4 version (2.4.0-rc5) and both version seems to have the issue. apiVersion: v1
kind: Secret
metadata:
annotations:
managed-by: argocd.argoproj.io
labels:
argocd.argoproj.io/secret-type: repository
name: repo-helm-repo
namespace: argocd
type: Opaque
stringData:
name: helm-repo
password: password
type: helm
url: https://private-repo.fr/charts
username: adminMy application file: apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: helm-test
spec:
destination:
namespace: test
server: 'https://kubernetes.default.svc'
source:
path: .
repoURL: 'https://gitlab.com/chart-dependency.git'
targetRevision: HEAD
project: some-projectAnd this is my apiVersion: v2
name: helm-test
version: 1.0.0
dependencies:
- name: helm-test
version: 1.0.0
repository: https://private-repo.fr/chartsWithout With I also tried setting my repository as an OCI one with the following settings for the repository : stringData:
enableOCI: "true"
name: helm-repo
password: password
type: helm
url: https://private-repo.fr/charts
username: adminand the passCredentials option for the app: source:
path: .
repoURL: 'https://gitlab.com/chart-dependency.git'
targetRevision: HEAD
helm:
passCredentials: trueUsing the URL with Do you guys have any update on this issue ? |
|
I also have the same issue using OCI repo from github, and adding the When I exec inside the repo-server pod and run |
I have same issues, but not fixed mine. |
|
I am having the same issue. Does anyone have a solution? |
|
Same issue, any updates? |
|
I had the same issue on 2.1. Eventually, after going over the code, I noticed that the helm repositories for apps are only being permitted by Eventually, I added the URL of the helm chart (for me, with Hope that helps |
|
I have the same issue with v2.8.4 |
|
I'm also running into this on v2.8.4, but not all environments. |
|
I have it working, currently on 2.7.10, do you guys have |
I've tried both. I can get it working with some repos but not others, even across multiple deployments of Argo in multiple clusters. Trying to figure out how to replicate it consistently before dumping too much more here 🙂 |
|
Has anyone gotten any real understanding what's going on here? And how to debug what the actual issue is? I am on v2.8.4 and get 401 when the main application points to a git repo which has a helm chart containing a dependency pointing to a helm registry. The dependency chart gets 401, and that's even when plenty of other applications works using the same helm registry directly |
|
I think we have the same issue using Argo CD version
To me, Just to be clear: what I refer to as an umbrella charts here is a Helm chart that declares a dependency on another chart in its dependencies:
- name: the-other-chart
version: 1.2.3
repository: http://example.com/the-private-helm-repoIn both The umbrella chart deployed in I think
I tried I tried hosting the .TGZ of my dependency charts in a public Helm repository, it worked, which confirms the credentials for a private Helm repo are lost in the way. A displeasing bug that seems to have been here for too long, now. |
|
I have no Go knowledge, but it might come from helmTemplate()... Although it doesn't seem right, as the repo is added in DependencyBuild()... |
|
Also observed with the newest version: {
"Version": "v2.9.3+6eba5be",
"BuildDate": "2023-12-01T23:05:50Z",
"GitCommit": "6eba5be864b7e031871ed7698f5233336dfe75c7",
"GitTreeState": "clean",
"GoVersion": "go1.21.3",
"Compiler": "gc",
"Platform": "linux/amd64",
"KustomizeVersion": "v5.2.1 2023-10-19T20:13:51Z",
"HelmVersion": "v3.13.2+g2a2fb3b",
"KubectlVersion": "v0.24.2",
"JsonnetVersion": "v0.20.0"
} |
Hi All, I am running into the same issues. After a lot of struggeling, my solution for a git hosted helm umbrella chart is to run on the git side of the umbrella chat "helm dep update" (or build, whatever you need) and push the /charts directory into git. greetz |
|
A workaround that doesn't require pushing TGZ dumps to Git is to use my own Config Management Plugin, with blackjack and hookers. The plugin adds the repos from the Kubernetes secrets and plugin.yaml:apiVersion: v1
kind: ConfigMap
metadata:
name: gh-7104-workaround-plugin
namespace: argo
data:
plugin.yaml: |-
apiVersion: argoproj.io/v1alpha1
kind: ConfigManagementPlugin
metadata:
name: gh-7104-workaround-plugin
spec:
init:
command:
- sh
- -c
args:
- helm-dependency-build # See below...
generate:
command:
- sh
- -c
- helm template "${PARAM_HELM_RELEASE_NAME:-$ARGOCD_APP_NAME}" "." --namespace "$ARGOCD_APP_NAMESPACE" --include-crds
helm-dependency-build.sh: |-
set -e
NAMESPACE="$(cat "/var/run/secrets/kubernetes.io/serviceaccount/namespace")"
TOKEN="$(cat "/var/run/secrets/kubernetes.io/serviceaccount/token")"
CACERT="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
# CURL to get the secrets annotated with argocd.argoproj.io/secret-type=repository,
# JQ to keep only the Helm repositories, I don't care about the Git repos here,
# HELM REPO ADD each of them before building the dependencies.
curl \
--silent \
--cacert "${CACERT}" \
--header "Authorization: Bearer ${TOKEN}" \
--request "GET" \
--url "https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/secrets?labelSelector=argocd.argoproj.io%2Fsecret-type%3Drepository" \
| jq \
--exit-status \
--monochrome-output \
--raw-output \
'.items[] | select(.data.type | @base64d == "helm") | .data | .name, .url, .username, .password | map_values(@base64d)' \
| while read -r "REPO_NAME"; read -r "REPO_URL"; read -r "REPO_USERNAME"; read -r "REPO_PASSWORD"; do
helm repo add "$REPO_NAME" "$REPO_URL" \
--username "$REPO_USERNAME" \
--password "$REPO_PASSWORD" \
--force-update
done
helm dependency build |
|
For anyone trying this out, there's a small error in the So something like this would do: apiVersion: v1
kind: ConfigMap
metadata:
name: gh-7104-workaround-plugin
namespace: argo
data:
plugin.yaml: |-
apiVersion: argoproj.io/v1alpha1
kind: ConfigManagementPlugin
metadata:
name: gh-7104-workaround-plugin
spec:
init:
command:
- sh
- -c
args:
- helm-dependency-build # See below...
generate:
command:
- sh
- -c
- helm template "${PARAM_HELM_RELEASE_NAME:-$ARGOCD_APP_NAME}" "." --namespace "$ARGOCD_APP_NAMESPACE" --include-crds
helm-dependency-build.sh: |-
set -e
NAMESPACE="$(cat "/var/run/secrets/kubernetes.io/serviceaccount/namespace")"
TOKEN="$(cat "/var/run/secrets/kubernetes.io/serviceaccount/token")"
CACERT="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
# CURL to get the secrets annotated with argocd.argoproj.io/secret-type=repository,
# JQ to keep only the Helm repositories, I don't care about the Git repos here,
# HELM REPO ADD each of them before building the dependencies.
curl \
--silent \
--cacert "${CACERT}" \
--header "Authorization: Bearer ${TOKEN}" \
--request "GET" \
--url "https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/secrets?labelSelector=argocd.argoproj.io%2Fsecret-type%3Drepository" \
| jq \
--exit-status \
--monochrome-output \
--raw-output \
'.items[] | select(.data.type | @base64d == "helm") | .data | map_values(@base64d) | .name, .url, .username, .password' \
| while read -r "REPO_NAME"; read -r "REPO_URL"; read -r "REPO_USERNAME"; read -r "REPO_PASSWORD"; do
helm repo add "$REPO_NAME" "$REPO_URL" \
--username "$REPO_USERNAME" \
--password "$REPO_PASSWORD" \
--force-update
done
helm dependency build
What we've also noticed is that it is possible to combine this with the argocd-vault-plugin, such that in the docs [1] [1] https://argocd-vault-plugin.readthedocs.io/en/stable/usage/#with-additional-helm-arguments |
|
For anyone else that may be hitting this issue, @steinarox link to #7858 is what fixed it for me. I needed to add a Before adding the |
and others
If you are trying to resolve an environment-specific issue or have a one-off question about the edge case that does not require a feature then please consider asking a question in argocd slack channel.
Checklist:
argocd version.Describe the bug
Password protected private helm repository throws an error when added as dependency to helm chart Chart.yaml file.
To Reproduce
or
and helm chart registry info
Expected behavior
ArgoCD Should be able to resolve helm chart dependencies using either repo-creds or repository secrets.
Screenshots
Version
Logs
NA
The text was updated successfully, but these errors were encountered: