public_git/helmfile
1
0
Fork 0
mirror of https://github.com/helmfile/helmfile.git synced 2026-10-19 01:45:37 +02:00
Code Issues Projects Releases Wiki Activity

fix: ensure OCI registry login when SkipRepos is set (#2701)

Browse Source 
* fix: ensure OCI registry login when SkipRepos is set (#1847)

Commands like build, status, list, and show-dag set SkipRepos: true to
avoid slow helm repo add/update for classic repos. However, this also
skipped helm registry login for OCI registries, causing 401 Unauthorized
errors when pulling OCI charts.

Add a variadic SyncOption parameter (backward compatible) with
WithOCIOnly() that limits repo processing to OCI registries only.
When skipRepos is true, callers now pass WithOCIOnly() so that OCI
authentication still happens before chart pulls.

Signed-off-by: yxxhero <aiopsclub@163.com>

* fix: reword OCI login comments per review feedback

RegistryLogin is a no-op when credentials are not configured, so the
word 'always' was misleading. Clarify that login is only needed when
credentials are present.

Signed-off-by: yxxhero <aiopsclub@163.com>

* fix: skip OCI login for commands that don't pull charts

Commands like 'list' and 'write-values' skip chart preparation entirely,
so OCI registry login is unnecessary for them. Extract the skip-command
list into a shared variable and use it to gate OCI-only login in
WithPreparedCharts.

Signed-off-by: yxxhero <aiopsclub@163.com>

* docs: clarify commandsSkipChartPrep comment per review feedback

Clarify that these commands only skip OCI login when skipRepos is true;
when skipRepos is false, SyncReposOnce still runs normally for all repos.

Signed-off-by: yxxhero <aiopsclub@163.com>

---------

Signed-off-by: yxxhero <aiopsclub@163.com>
This commit is contained in:
yxxhero
2026-07-12 09:51:24 +08:00
committed by GitHub
parent 09afa425d7
commit 43aafeaad1
4 changed files with 127 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/app/context.go
+2 -2
View File
@@ -17,11 +17,11 @@ func NewContext() Context {
}
}
func (ctx *Context) SyncReposOnce(st *state.HelmState, helm state.RepoUpdater) error {
func (ctx *Context) SyncReposOnce(st *state.HelmState, helm state.RepoUpdater, opts ...state.SyncOption) error {
ctx.mu.Lock()
defer ctx.mu.Unlock()
updated, err := st.SyncRepos(helm, ctx.updatedRepos)
updated, err := st.SyncRepos(helm, ctx.updatedRepos, opts...)
for _, r := range updated {
ctx.updatedRepos[r] = true
pkg/app/run.go
+26 -10
View File
@@ -42,10 +42,15 @@ func (r *Run) askForConfirmation(msg string) bool {
return AskForConfirmation(msg)
}
// commandsSkipChartPrep lists commands that don't prepare or pull charts.
// These commands skip chart preparation, and when skipRepos is true they also
// skip the OCI-only registry login (since no chart pulls need authentication).
// When skipRepos is false, SyncReposOnce still runs normally for all repos.
var commandsSkipChartPrep = []string{"write-values", "list"}
func (r *Run) prepareChartsIfNeeded(helmfileCommand string, dir string, concurrency int, opts state.ChartPrepareOptions) (map[state.PrepareChartKey]string, error) {
// Skip chart preparation for certain commands
skipCommands := []string{"write-values", "list"}
if slices.Contains(skipCommands, strings.ToLower(helmfileCommand)) {
// Skip chart preparation for commands that don't need chart pulls
if slices.Contains(commandsSkipChartPrep, strings.ToLower(helmfileCommand)) {
return nil, nil
}
@@ -67,10 +72,17 @@ func (r *Run) WithPreparedCharts(helmfileCommand string, opts state.ChartPrepare
// - skipRefresh explicitly means "don't update repos"
// - skipDeps implies "I have all dependencies locally" which means repo data isn't needed
// This matches the CLI behavior where --skip-deps and --skip-refresh both skip repo operations.
// However, OCI registries need `helm registry login` before chart pulls when
// credentials are configured (issue #1847), so when skipRepos is true we still
// perform OCI-only login — but only for commands that actually pull charts.
needsChartPrep := !slices.Contains(commandsSkipChartPrep, strings.ToLower(helmfileCommand))
skipRepos := opts.SkipRepos || r.state.HelmDefaults.SkipDeps || r.state.HelmDefaults.SkipRefresh
if !skipRepos {
ctx := r.ctx
if err := ctx.SyncReposOnce(r.state, r.helm); err != nil {
if err := r.ctx.SyncReposOnce(r.state, r.helm); err != nil {
return err
}
} else if needsChartPrep {
if err := r.ctx.SyncReposOnce(r.state, r.helm, state.WithOCIOnly()); err != nil {
return err
}
}
@@ -140,12 +152,16 @@ func (r *Run) WithPreparedCharts(helmfileCommand string, opts state.ChartPrepare
func (r *Run) Deps(c DepsConfigProvider) []error {
// Check both CLI options and helmDefaults for skipping repos (issue #2296)
// Both skipDeps and skipRefresh cause repo sync to be skipped (see withPreparedCharts for rationale)
// Both skipDeps and skipRefresh cause repo sync to be skipped (see WithPreparedCharts for rationale).
// OCI registries need login before chart pulls when credentials are
// configured (issue #1847), so skipRepos=true still performs OCI-only login.
skipRepos := c.SkipRepos() || r.state.HelmDefaults.SkipDeps || r.state.HelmDefaults.SkipRefresh
if !skipRepos {
if err := r.ctx.SyncReposOnce(r.state, r.helm); err != nil {
return []error{err}
}
var repoOpts []state.SyncOption
if skipRepos {
repoOpts = append(repoOpts, state.WithOCIOnly())
}
if err := r.ctx.SyncReposOnce(r.state, r.helm, repoOpts...); err != nil {
return []error{err}
}
r.helm.SetExtraArgs(GetArgs(c.Args(), r.state)...)