Confusing HelmRepository OCI status #1249
Labels
area/helm
Helm related issues and pull requests
area/oci
OCI related issues and pull requests
enhancement
New feature or request
HelmRepository OCI, implemented as per RFC-0002, has a dedicated reconciler,
HelmRepositoryOCIReconciler
, which reconciles the HelmRepository objects with.spec.type
valueoci
and patches the result of reconciliation in the object status. The reconciliation involves validation of the repository URL and performing a login to the OCI registry.Since the release of HelmRepository OCI support, there have been multiple reports about HelmRepository showing everything to be good and ready but HelmChart failing to pull the OCI chart and confusing the users. For example, a HelmRepository
Corresponding HelmChart fails with the following error:
Because the initial HelmRepository implementation in Flux was based on the non-OCI helm design where the HelmRepository downloaded helm chart index and the index is used by HelmCharts, HelmRepository OCI using the same HelmRepository API may lead the users to believe that any authentication failure would happen in HelmRepository and be visible in HelmRepository object itself. But since HelmRepository OCI doesn't provide any artifact that the corresponding HelmCharts need, that's not the case anymore. For OCI charts, HelmRepository is just a container to store information about how OCI registry from where the charts can be downloaded. The HelmRepository OCI object itself doesn't contain any information about the individual charts. The underlying HelmRepositoryOCIReconciler can't perform accurate authentication and guarantee that that HelmCharts will be able to authenticate too. HelmRepository OCI performs authentication against the registry host. It's possible that the credentials may not have pull access to particular charts in the registry.
As mentioned before, HelmRepositoryOCIReconciler only performs URL validation and registry host authentication, it doesn't provide any artifact. The associated HelmCharts perform authentication when pulling the OCI charts. This leaves HelmRepository OCI to provide very less value compared to the other source reconcilers. HelmChart reconciler does all the necessary operations for OCI charts. Since HelmCharts can work without running a dedicated reconciler just for validation and registry host authentication for HelmRepository, removing the HelmRepositoryOCIReconciler will not make any difference. The HelmRepository OCI objects can become static object without any reconciler reporting any status. This would help reduce the confusion.
NOTE: This change is inspired by the fluxcd/notification-controller#540 which introduces static Alerts and Providers API in notification-controller. Prerequisites for static objects have been discussed in the notification-controller change and addressed in the recent versions of Flux.
Following are some issues and slack threads where this confusion was observed:
TODOs for addressing the issue:
get sources helm
output Add support for HelmRepo OCI and NC v1beta3 static objects flux2#4298The text was updated successfully, but these errors were encountered: