Giters

kokuwaio / helm-maven-plugin

Simple plugin to package helm charts

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Helm insecure flag is not honored when performing a push to insecure repo

steromano87 opened this issue · comments

commented

Is this a request for help?:
YES

Is this a BUG REPORT or FEATURE REQUEST? (choose one):
BUG REPORT

Environment (plugin version, maven version, OS, ...):
Plugin version: 6.7.0
Helm repo type: Harbor (with self signed certificate)

What happened:
I configured the Harbor OCI registry login as a separate step and I added the insecure flag. It worked correctly.

However, when I try and upload my chart using the push goal, the login is re-attempted. This login attempt does not honor the insecure flag, so the build fails.

What you expected to happen:

  • if a previous login was already performed, the login part should be skipped
  • the insecure option should be added to the push goal to allow tghe push to insecure registries. Helm provides the --insecure-skip-tls-verify option to bypass the certificate during push.

How to reproduce it (as minimally and precisely as possible):

  1. Spin up a Harbor registry (or any registry that uses a self-signed certificate)
  2. Build a chart
  3. Try to upload the chart to the insecure registry using the push goal

Anything else we need to know:
Currently we are bypassing this issue by using the exec-maven-plugin and performing the push command outside the plugin, however this approach works only if the Helm executable is in the path.

commented

Thanks for your report.

I'll add the flag to skip login with helm:push. This login was implemented with helm:push before helm:registry-login was created. I've added a warning to migrate to helm:registry-login.

commented

@steromano87 i've created a pull request #303 Can you verify that this is a solution for your issue?

commented

Hi @sschnabe, thanks for the fix!
However I think that this commit solves the problem only partially...

The TLS certificate is checked twice, once during login and once when pushing an OCI artifact. Your fix correctly addresses the login check, however an additional insecure flag should be added to the helm-push goal to set the Helm option to skip the TLS check during push phase.

commented

From my point of view this was added with #304. Can you verify this?

commented

Hi @sschnabe, yes, the mentioned merge request covers this case. Can you please link this issue to that MR, to keep track of the resolution?

commented

With mentioning the pr its attached in this issues and the pr.

Both prs are released as 6.8.0

commented

Hi @sschnabe, I'm using version 6.9.0 of the plugin and I still have this issue: adding the insecure flag only fixes the helm:registry-login issue, but not the helm:push one:

[INFO] --- helm-maven-plugin:6.9.0:push (default-cli) @ core ---
[INFO] Use 3.12.2 as helm version
[INFO] Uploading /home/daniele/workspace/dan-shop-core/target/helm/repo/dan-shop-core-service-0.0.1-SNAPSHOT.tgz...
[ERROR] Error: failed to do request: Head "https://minikube.nexus-docker-dan-snapshot-http:30501/v2/dan-shop-core-service/blobs/sha256:168262311e5e887e5a61229248000d146d3691647fd080d39a7d04cebdd910bf": http: server gave HTTP response to HTTPS client

I'm running the following command:

 mvn helm:init helm:dependency-build helm:lint helm:package helm:registry-login helm:push

And here is the plugin configuration:

<insecure>true</insecure>
<skipPushLogin>true</skipPushLogin>
<chartVersion>${project.version}</chartVersion>
<chartDirectory>${project.basedir}/${project.name}</chartDirectory>
<autoDetectLocalHelmBinary>false</autoDetectLocalHelmBinary>
<helmDownloadUrl>https://get.helm.sh/helm-v3.12.2-linux-amd64.tar.gz</helmDownloadUrl>

<uploadRepoStable>
    <name>release-repo</name>
    <url>${docker.repository.release}</url>
    <type>NEXUS</type>
    ...