argo-cd: unable to pull helm charts from oci registry (InvalidSpecError)

If you are trying to resolve an environment-specific issue or have a one-off question about the edge case that does not require a feature then please consider asking a question in argocd slack channel.

Checklist:

  • I’ve searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
  • I’ve included steps to reproduce the bug.
  • I’ve pasted the output of argocd version.

Describe the bug

When attempting to pull a chart from aws ecr, i receive the following helm error

Unable to save changes: application spec is invalid: InvalidSpecError: Unable to get app details: rpc error: code = Unknown desc = `helm chart pull https://<account id>>.dkr.ecr.<region>.amazonaws.com/helm-charts/appname:2.0.2` failed exit status 1: Error: ref may only contain a single colon character (:) unless specifying a port number

It looks like argocd is construction the wrong syntax for the helm chart pull command. I can reproduce the error from my terminal using a dummy registry (removing any reference to aws)

helm chart pull https://my-example-reg.example-registry/myapp:1.0.0
Error: ref may only contain a single colon character (:) unless specifying a port number

To Reproduce

  • Add repo to argocd with oci support
  • Confirm the repo exists within argocd, with oci enabled.
  • Update an existing application definition use the oci repo. Example of my config below;
project: default
source:
  repoURL: https://<aws_account_id>.dkr.ecr.<region>.amazonaws.com # replace with amazon account and region
  targetRevision: 0.2.0
  plugin:
    name: not-important-info
    env:
      - name: my-env-var
        value: test-var
  enableOCI: true
  chart: helm-charts/my-app
destination:
  namespace: test
  name: test-cluster
syncPolicy:
  automated:
    prune: true
    selfHeal: true

On save, you will receive the error reported above.

Expected behavior

The application definition should successfully update app definition, and pull chart from aws ecr.

Version

1.8.4

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 16

Most upvoted comments

By using a Kubernetes cronjob that refreshes token to a secret available to Argo every 6 hours. Works well.

i think the repo should be added without the protocol argocd repo add <aws_account_id>.dkr.ecr.<region>.amazonaws.com --type helm --name charts --enable-oci

However argocd is not able to obtain token and authenticate (for ecr at least, as it needs to first obtain a session token.