feat: add GAR Helm chart support to credential providers #4637

filip-aipl · 2025-07-17T18:06:14Z

Summary

Adds Google Artifact Registry (GAR) Helm chart support to existing credential providers.

Changes

Enable credentials.TypeHelm support in GAR ServiceAccountKeyProvider and WorkloadIdentityFederationProvider
Update regex patterns to handle oci:// prefix for GAR/GCR Helm chart URLs
Document GAR Helm chart authentication in user guides

Problem Solved

Fixes "Unauthenticated request" errors when Kargo warehouses attempt to discover Helm charts from Google Artifact Registry repositories.

Testing

All existing tests pass
New test cases verify Helm chart authentication support
Follows existing ECR provider patterns for consistency
Tested live on local Kargo build with existing registries

- Add TypeHelm support to GAR ServiceAccountKeyProvider and WorkloadIdentityFederationProvider - Update regex patterns to handle oci:// prefix for GAR Helm charts Fixes "Unauthenticated request" errors when Kargo warehouses discover Helm charts from Google Artifact Registry. Signed-off-by: Filip Nowak <filip@airspace-intelligence.com>

Add documentation for authenticating with Google Artifact Registry OCI Helm chart repositories, including credential setup and warehouse subscription examples. Signed-off-by: Filip Nowak <filip@airspace-intelligence.com>

netlify · 2025-07-17T18:06:19Z

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	`4939fdb`
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/68a41192eb9f980008b412aa
😎 Deploy Preview	https://deploy-preview-4637.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

filip-aipl · 2025-08-05T10:11:23Z

Is there anything else I have to do on my side? @hiddeco

krancour · 2025-08-19T16:31:43Z

docs/docs/50-user-guide/20-how-to-guides/30-working-with-warehouses.md

+  For OCI Helm chart repositories (like Google Artifact Registry), use the `oci://` prefix and omit the `name` field:
+
+  ```yaml
+  spec:
+    subscriptions:
+    - chart:
+        repoURL: oci://us-central1-docker.pkg.dev/my-project/my-helm-charts/my-chart
+        semverConstraint: ^1.0.0
+  ```
+


I think this was covered already on lines 634 - 636.

Suggested change

For OCI Helm chart repositories (like Google Artifact Registry), use the `oci://` prefix and omit the `name` field:

```yaml

spec:

subscriptions:

- chart:

repoURL: oci://us-central1-docker.pkg.dev/my-project/my-helm-charts/my-chart

semverConstraint: ^1.0.0

```

krancour · 2025-08-19T16:32:24Z

docs/docs/50-user-guide/20-how-to-guides/30-working-with-warehouses.md

 ## Working with Private Repositories

 Frequently, `Warehouse`s require access to private repositories, in which case
 appropriate credentials must be made available in some form. The many available
 authentication options are covered in detail on the
 [Managing Credentials](../50-security/30-managing-credentials.md) page.

+


Not sure why this line was added, but most markdown linters do not like double line breaks.

Suggested change

krancour · 2025-08-19T16:37:19Z

docs/docs/50-user-guide/50-security/30-managing-credentials.md

@@ -532,6 +532,21 @@ stringData:
  repoURL: <artifact registry url>


It may be worth replacing or augmenting this with an example, since image repo URLs do not have leading oci:// while chart repo URLs do.

krancour · 2025-08-19T16:37:39Z

docs/docs/50-user-guide/50-security/30-managing-credentials.md

+    kargo.akuity.io/cred-type: helm
+stringData:
+  gcpServiceAccountKey: <base64-encoded service account key>
+  repoURL: <oci helm chart repository url>


Same as here.

krancour · 2025-08-19T16:39:53Z

docs/docs/50-user-guide/50-security/30-managing-credentials.md

@@ -532,6 +532,21 @@ stringData:
  repoURL: <artifact registry url>
 ```

+For OCI Helm chart repositories, the `Secret` should be labeled with `helm` instead:


This feels like an "afterthought." I'd suggest that we rewind all the way to line 520 and introduce the two examples like:

To use this option, your `Secret` should take the following form: * For a container image repository: ```yaml < example goes here> ``` * For an OCI Helm chart repository: ```yaml < example goes here> ```

krancour · 2025-08-19T16:43:31Z

internal/credentials/kubernetes/gar/service_account_key.go

@@ -37,7 +38,13 @@ func NewServiceAccountKeyProvider() credentials.Provider {
 }

 func (p *ServiceAccountKeyProvider) Supports(credType credentials.Type, repoURL string, data map[string][]byte) bool {
-	if credType != credentials.TypeImage || data == nil || data[serviceAccountKeyKey] == nil {
+	if (credType != credentials.TypeImage && credType != credentials.TypeHelm) ||


Nit: This feels easier to comprehend, although this isn't a hill I'd die on. Up to you.

Suggested change

if (credType != credentials.TypeImage && credType != credentials.TypeHelm) ||

if !(credType == credentials.TypeImage || credType == credentials.TypeHelm) ||

krancour · 2025-08-19T16:56:43Z

internal/credentials/kubernetes/gar/service_account_key_test.go

 		fakeGCRRepoURL        = "gcr.io/my-project/my-repo"
 		fakeGARRepoURL        = "us-central1-docker.pkg.dev/my-project/my-repo"
+		fakeGCROCIRepoURL     = "oci://gcr.io/my-project/my-repo"
+		fakeGAROCIRepoURL     = "oci://us-central1-docker.pkg.dev/my-project/my-repo"


All of these are OCI. Helm charts are just more in your face about the fact because, for whatever reason, Helm chose to use a leading oci:// with URLs for OCI repos. Kargo just follows their lead, because if that's what Helm users are accustomed to, who are we to argue?

I would suggest naming these this way for accuracy and clarity:

Suggested change

fakeGCRRepoURL = "gcr.io/my-project/my-repo"

fakeGARRepoURL = "us-central1-docker.pkg.dev/my-project/my-repo"

fakeGCROCIRepoURL = "oci://gcr.io/my-project/my-repo"

fakeGAROCIRepoURL = "oci://us-central1-docker.pkg.dev/my-project/my-repo"

fakeGCRImageRepoURL = "gcr.io/my-project/my-repo"

fakeGARImageRepoURL = "us-central1-docker.pkg.dev/my-project/my-repo"

fakeGCRChartRepoURL = "oci://gcr.io/my-project/my-repo"

fakeGARChartRepoURL = "oci://us-central1-docker.pkg.dev/my-project/my-repo"

krancour · 2025-08-19T17:07:18Z

internal/credentials/kubernetes/gar/common.go

+	gcrURLRegex = regexp.MustCompile(`^(?:oci://)?(?:.+\.)?gcr\.io/`) // Legacy
+	garURLRegex = regexp.MustCompile(`^(?:oci://)?(.+-docker\.pkg\.dev/)`)


The scope of this PR creeps too much if we want to fix this now, so I'd like to just leave this note here for myself.

Suggested change

gcrURLRegex = regexp.MustCompile(`^(?:oci://)?(?:.+\.)?gcr\.io/`) // Legacy

garURLRegex = regexp.MustCompile(`^(?:oci://)?(.+-docker\.pkg\.dev/)`)

// TODO(krancour): Repo URLs are not currently normalized prior to credential

// providers being invoked. When that is fixed, the optional leading `oci://`

// can be removed from these regular expressions.

gcrURLRegex = regexp.MustCompile(`^(?:oci://)?(?:.+\.)?gcr\.io/`) // Legacy

garURLRegex = regexp.MustCompile(`^(?:oci://)?(.+-docker\.pkg\.dev/)`)

krancour · 2025-08-19T17:13:51Z

internal/credentials/kubernetes/gar/workload_identity_federation_test.go

+		fakeProjectID     = "test-project"
+		fakeGCRRepoURL    = "gcr.io/my-project/my-repo"
+		fakeGARRepoURL    = "us-central1-docker.pkg.dev/my-project/my-repo"
+		fakeGCROCIRepoURL = "oci://gcr.io/my-project/my-repo"
+		fakeGAROCIRepoURL = "oci://us-central1-docker.pkg.dev/my-project/my-repo"


Same as here.

krancour · 2025-08-19T21:03:23Z

Thank you for this @filip-aipl. I left some minor, easily-addressable comments. This all checks out end-to-end. As soon as this is cleaned up, I'll approve. Thanks again!

codecov · 2025-08-19T21:09:00Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.17%. Comparing base (11ea88a) to head (4939fdb).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4637      +/-   ##
==========================================
+ Coverage   54.16%   54.17%   +0.01%     
==========================================
  Files         395      395              
  Lines       33896    33904       +8     
==========================================
+ Hits        18359    18367       +8     
  Misses      14608    14608              
  Partials      929      929

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

filip-aipl added 2 commits July 17, 2025 20:02

docs: add GAR Helm chart authentication examples

456312b

Add documentation for authenticating with Google Artifact Registry OCI Helm chart repositories, including credential setup and warehouse subscription examples. Signed-off-by: Filip Nowak <filip@airspace-intelligence.com>

filip-aipl requested review from a team as code owners July 17, 2025 18:06

hiddeco added kind/enhancement priority/normal area/controller labels Jul 21, 2025

krancour assigned krancour and filip-aipl Aug 12, 2025

krancour added this to the v1.8.0 milestone Aug 12, 2025

Merge branch 'main' into filip-aipl/add-gar-helm-support-signed

4939fdb

krancour reviewed Aug 19, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add GAR Helm chart support to credential providers #4637

feat: add GAR Helm chart support to credential providers #4637

Uh oh!

filip-aipl commented Jul 17, 2025 •

edited by krancour

Loading

Uh oh!

netlify bot commented Jul 17, 2025 •

edited

Loading

Uh oh!

filip-aipl commented Aug 5, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025 •

edited

Loading

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour Aug 19, 2025

Uh oh!

krancour commented Aug 19, 2025

Uh oh!

codecov bot commented Aug 19, 2025

Uh oh!

Uh oh!

		@@ -532,6 +532,21 @@ stringData:
		repoURL: <artifact registry url>

	if (credType != credentials.TypeImage && credType != credentials.TypeHelm) \|\|
	if !(credType == credentials.TypeImage \|\| credType == credentials.TypeHelm) \|\|

		gcrURLRegex = regexp.MustCompile(`^(?:oci://)?(?:.+\.)?gcr\.io/`) // Legacy
		garURLRegex = regexp.MustCompile(`^(?:oci://)?(.+-docker\.pkg\.dev/)`)

feat: add GAR Helm chart support to credential providers #4637

Are you sure you want to change the base?

feat: add GAR Helm chart support to credential providers #4637

Uh oh!

Conversation

filip-aipl commented Jul 17, 2025 • edited by krancour Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Problem Solved

Testing

Uh oh!

netlify bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for docs-kargo-io ready!

Uh oh!

filip-aipl commented Aug 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

krancour Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

krancour commented Aug 19, 2025

Uh oh!

codecov bot commented Aug 19, 2025

Codecov Report

Uh oh!

Uh oh!

filip-aipl commented Jul 17, 2025 •

edited by krancour

Loading

netlify bot commented Jul 17, 2025 •

edited

Loading

krancour Aug 19, 2025 •

edited

Loading