helm: Cannot push to HTTPS registry with self-signed certificate
I run an Harbor Repository and on the client I use helm 3.8.0. Client is Ubuntu. What is the hack to push the chart to a insecure registry?
If i try to push a helm chart to that registry I always get:
helm push btcsp-umbrella-1.0.0.tgz oci://harbor.osc.local/btcsp-staging
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /home/developer/.kube/config
Error: failed to do request: Head "https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:a6cf34fd818a273010c54a86c69fbf42d3630d8bd2c18b227702905dd50e8ed5": x509: certificate signed by unknown authority
I tried with helm registry login with --insecure flag and this report login successful.
The output with helm push and --debug is:
helm push btcsp-umbrella-1.0.0.tgz oci://harbor.osc.local/btcsp-staging --debug
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /home/developer/.kube/config
WARN[0000] reference for unknown type: application/vnd.cncf.helm.chart.content.v1.tar+gzip
DEBU[0000] checking and pushing to url="https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:9c490d861642afe351815bca43c9ec2f97a02ccd328ca7ff3332843fb1c6a9d8"
DEBU[0000] do request request.header.accept="application/vnd.cncf.helm.chart.content.v1.tar+gzip, */*" request.header.user-agent=Helm/3.8.0 request.method=HEAD url="https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:9c490d861642afe351815bca43c9ec2f97a02ccd328ca7ff3332843fb1c6a9d8"
WARN[0000] reference for unknown type: application/vnd.cncf.helm.config.v1+json
DEBU[0000] checking and pushing to url="https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:a6cf34fd818a273010c54a86c69fbf42d3630d8bd2c18b227702905dd50e8ed5"
DEBU[0000] do request request.header.accept="application/vnd.cncf.helm.config.v1+json, */*" request.header.user-agent=Helm/3.8.0 request.method=HEAD url="https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:a6cf34fd818a273010c54a86c69fbf42d3630d8bd2c18b227702905dd50e8ed5"
Error: failed to do request: Head "https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:9c490d861642afe351815bca43c9ec2f97a02ccd328ca7ff3332843fb1c6a9d8": x509: certificate signed by unknown authority
helm.go:84: [debug] Head "https://harbor.osc.local/v2/btcsp-staging/btcsp-umbrella/blobs/sha256:9c490d861642afe351815bca43c9ec2f97a02ccd328ca7ff3332843fb1c6a9d8": x509: certificate signed by unknown authority
failed to do request
github.com/containerd/containerd/remotes/docker.(*request).do
github.com/containerd/containerd@v1.5.9/remotes/docker/resolver.go:569
github.com/containerd/containerd/remotes/docker.(*request).doWithRetries
github.com/containerd/containerd@v1.5.9/remotes/docker/resolver.go:576
github.com/containerd/containerd/remotes/docker.dockerPusher.push
github.com/containerd/containerd@v1.5.9/remotes/docker/pusher.go:118
github.com/containerd/containerd/remotes/docker.dockerPusher.Push
github.com/containerd/containerd@v1.5.9/remotes/docker/pusher.go:65
oras.land/oras-go/pkg/oras.pusherIngester.Writer
oras.land/oras-go@v1.1.0/pkg/oras/store.go:212
oras.land/oras-go/pkg/oras.(*hybridStore).Writer
oras.land/oras-go@v1.1.0/pkg/oras/store.go:106
oras.land/oras-go/pkg/oras.(*hybridStore).Push
oras.land/oras-go@v1.1.0/pkg/oras/store.go:72
oras.land/oras-go/pkg/oras.transferContent.func2.1
oras.land/oras-go@v1.1.0/pkg/oras/copy.go:111
oras.land/oras-go/pkg/oras.transferContent.func3
oras.land/oras-go@v1.1.0/pkg/oras/copy.go:137
github.com/containerd/containerd/images.HandlerFunc.Handle
github.com/containerd/containerd@v1.5.9/images/handlers.go:55
github.com/containerd/containerd/images.Handlers.func1
github.com/containerd/containerd@v1.5.9/images/handlers.go:65
github.com/containerd/containerd/images.HandlerFunc.Handle
github.com/containerd/containerd@v1.5.9/images/handlers.go:55
github.com/containerd/containerd/images.Dispatch.func1
github.com/containerd/containerd@v1.5.9/images/handlers.go:134
golang.org/x/sync/errgroup.(*Group).Go.func1
golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c/errgroup/errgroup.go:57
runtime.goexit
runtime/asm_amd64.s:1581
The commands are:
helm package btcsp/
helm registry login harbor.osc.local --insecure --username johnDoe --password johnDoe
helm push btcsp-umbrella-1.0.0.tgz oci://harbor.osc.local/btcsp-staging
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Reactions: 2
- Comments: 27 (5 by maintainers)
This bug is not stale.
Maybe 3.8.1 release, this pr wait @antgamdia to merge the pr: https://github.com/helm/helm/pull/10638 .
As a workaround you can try copy certificate of CA to
/usr/local/share/ca-certificates/
and callupdate-ca-certificates
Should be fixed in 3.8.1…unbelievable
This may be related to https://github.com/helm/helm/pull/10408 which should be fixed in 3.8.1
@ognif - do you want to try that changeset and see if it fixes your issue?