method to provide credentials to private helm repositories

[cburroughs]

Is your feature request related to a problem? Please describe.

I have a helm chart in pants, and I'd like to depend on another helm chart in a private chart repository. The chart works fine with helm repo add (showing up in ~/.config/helm/repositories.yaml), but trying to use a chart from that repository with causes pants to fail with 401 Unauthorized.

Looking in the sandbox, I can see that we set HELM_CONFIG_HOME=__config which is empty:

__config/

0 directories, 0 files

So it makes sense that it is unauthorized as no authentication is being provided.

Describe the solution you'd like
I like a way to have pants use credentials to access private helm repositories.

Describe alternatives you've considered

• helm doesn't support .netrc files, and I presume pants's sandbox would thwart that anyway Feature request: helm - allow the use of .netrc as an authentication alternative in add repo helm/helm#9586
• Embedding the username/password in the url given to pants, which is a non-starter for config that gets checked in.

Additional context

• The docs have a section on publishign charts, https://www.pantsbuild.org/docs/helm-overview#publishing-helm-charts and I admit that makes me feel like I'm missing something because how would publishing work without authentication?
• Sealing away the ~/.config/helm feels correct in some sense, but is also inconsistent with how pant treats docker and kubectl.

[lilatomic]

Hm, seems we hardcode overriding the HELM_CONFIG_HOME with the comment "Helm binary's setup parameters go last to prevent end users overriding any of its values." ref .

I think we've got a few options:

1. Allow passing that envvar through. I'm not sure that files would be are placed in "__config" dir, so this might be safe. similar to the docker backend ref
2. (optionally) collect the config dir into the digest and stash it in "__config". I'm not sure how the cache will interact with this given that the files might contain secrets
3. allow passthrough of the --repository-config arg
4. envvar interpolation like the python backend ref.

thoughts? @alonsodomin

[alonsodomin]

This is very related to other features of Helm that either are half-supported or I would like to support at some point, like the usage of provenance files/signing chart packages etc. All of these features need Pants to have read-only access to files that are outside of the workspace.

At this moment, the publishing and deploying workaround this by the fact that those are implemented as InteractiveProcess, which runs in the foreground (unlike when fetching third party artifacts) and that the sandbox being used by the Helm backend is not super hermetic as it leaks into user's home folder so Helm can read kubectl config stored in there.

The fetching (and publishing) of third parties in an access protected repository is a common problem across backends though and most likely is calling for a general solution that can be used across all backends. In a way also related to having read-only access to files that are outside of the workspace as files with credential info should never be checked into version control. This would also need to answer on how cache invalidation would work in regards to those files.

A workaround solution could be to ask the user to have those kind of files inside the workspace but also listed to be excluded from being checked into version control. This feels a bit error prone though as could lead to mistakenly leaking sensitive data (which is very bad) and, at the same, it may not work as we want as Pants also reads the contents of .gitignore...

All in all, this is a very legitimate request but not very simple to solve and that seems to require a general approach.