Unable to push Helm Chart to Google Cloud Artifact Registry using OCI

user_1349275 0
Viewed 1031

I'm trying to push a helm chart to Google Cloud OCI registry (Artifact Registry) but I get forbidden error:

helm push testapp-1.0.0.tgz oci://europe-north1-docker.pkg.dev/project-id/my-artifact-registry/

Error: failed to authorize: failed to fetch anonymous token: unexpected status: 403 Forbidden

It seems that I'm authenticated ok since when I do try to push it but without "oci://" it works fine:

helm chart push europe-north1-docker.pkg.dev/project-id/my-artifact-registry/charts/testapp:1.0.0

The push refers to repository [europe-north1-docker.pkg.dev/..]
ref: europe-north1-docker.pkg.dev/...
digest: 2757354aef8af2db48261d52c17c0df35a99d6fccaf016b0e67e167c391b69c7
size:3.9 KiB
name: testapp
version: 1.0.0
1.0.0: pushed to remote (1 layer, 3.9 KiB total)

I logged in to the helm registry using service account json key, using below command:

helm registry login -u _json_key_base64 --password <base_64_key> https://europe-north1-docker.pkg.dev

and this service-account has below roles:

roles/artifactregistry.admin
roles/artifactregistry.repoAdmin
roles/artifactregistry.writer
roles/container.developer
roles/storage.admin
roles/storage.objectViewer

Is there any specific permission needs to be enabled in GCP to use "OCI" protocol?

or any service need to be enabled?

or any different authentication required?

I followed the instructions here but with no success

helm3 google-cloud-platform
2 Answers

its funny, but this is not the first time it happens to me... once I submit the question to Stackoverflow, something hits me and I'm able to find the problem with my issue!!

Anyway, the problem is basically with the authentication, where the URL to login to should be in the format of:

https://LOCATION-docker.pkg.dev/PROJECT/REPOSITORY

like this:

helm registry login -u _json_key_base64 --password <base_64_key> \
   https://europe-north1-docker.pkg.dev/project-id/my-artifact-registry
user_13492750

I faced the same issue but using Cloudbuild. I am glad if this snippet of code can help someone.

steps:
  - name: 'alpine/helm:3.9.1'
    id: 'helm package'
    args: ['package', '.']
  - name: 'alpine/helm:3.9.1'
    id: 'helm push'
    env:
      - 'HELM_REGISTRY_CONFIG=../builder/home/.docker/config.json'
    entrypoint: 'sh'
    args:
      - '-c'
      - |
        helm push --debug mylibchart-*.tgz oci://europe-west3-docker.pkg.dev/$PROJECT_ID/helm-registry

Basically in the step where we want to push our *.tgz., we need to set the env HELM_REGISTRY_CONFIG equal to the default path of the docker config.json.

user_96333960
Related