Declaring credentials for private OCI registry hosting Helm Chart

[ginkel]

Hi there,

I am currently trying to reference a Helm Chart that is hosted in our GitLab Container registry. The repo is non-public, so auth is required to pull from it.

Unfortunately, I can't seem to manage to get this working. ArgoCD's attempts to pull from the OCI registry always end with a 403 error whereas manual attempts to do so (using the same credentials) work fine.

My application looks like this:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "100"
  name: foo
  namespace: argocd
spec:
  destination:
    namespace: foo
    server: https://kubernetes.default.svc
  project: project
  sources:
  - helm:
      passCredentials: true
      valueFiles:
      - $values/apps/foo.yaml
    path: .
    repoURL: oci://docker.foo.example/user/foo/helm/foo
    targetRevision: 0.0.0-f2ec78a
  - ref: values
    repoURL: [email protected]:foo/k8s-config.git
    targetRevision: main
  syncPolicy:
    automated:
      allowEmpty: false
      prune: true
    retry:
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 5m
      limit: 10
    syncOptions:
    - CreateNamespace=true
    - PruneLast=true
    - ApplyOutOfSyncOnly=true

The corresponding secret looks like this:

apiVersion: v1
kind: Secret
metadata:
  name: argocd-repocreds-docker-foo-example
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repo-creds
type: Opaque
stringData:
  url: docker.foo.example
  username: user
  password: password
  type: helm
  enableOCI: "true"

I also tried this variant with no success:

apiVersion: v1
kind: Secret
metadata:
  name: argocd-repocreds-docker-foo-example
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repo-creds
type: Opaque
stringData:
  url: https://docker.foo.example
  username: user
  password: password
  type: helm
  enableOCI: "true"

Any hints what I am missing are much appreciated!

Thanks,
Thilo

[joshwright10]

Try to remove the oci:// prefix in the Application crd.
Ours is working with a repository definition, as we don't need to use a repo-creds

apiVersion: v1
kind: Secret
metadata:
  name: repo-helm-oci-acr
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: helm
  url: myacr.azurecr.io/helm
  enableOCI: "true"
  useAzureWorkloadIdentity: "true"

Then the Application crd looks like this when rendered:

sources:
  - repoURL: myacr.azurecr.io/helm
    chart: standard-workload
    targetRevision: 0.1.0
    helm:
      valueFiles:
        - myvalues.yaml

In reality, it is more complicated, as we use templatePatch to build the sources from a config.json, but essentially this is the rendered result.
To summarise:

1. Try removing oci://
2. Try switching from repo-creds to repository secret-type.