Helm Repositories

1 - Repository types

2 - Managing repositories

2.1 Basic commands

# Ajouter un repository
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add --username user --password pass private https://charts.private.com

# Lister les repositories
helm repo list

# Mettre à jour les index
helm repo update
helm repo update bitnami  # Un seul repo

# Supprimer un repository
helm repo remove bitnami

# Voir l'index d'un repo (debug)
cat ~/.cache/helm/repository/bitnami-index.yaml

2.2 Search for charts

# Rechercher sur Artifact Hub
helm search hub nginx
helm search hub prometheus --max-col-width 80

# Rechercher dans les repos configurés
helm search repo nginx
helm search repo bitnami/nginx

# Avec version spécifique
helm search repo nginx --version ">=1.0.0"
helm search repo nginx --versions  # Toutes les versions

# Recherche avec regex
helm search repo "kube-*"

3 - Popular public repositories

3.1 Configuration

# Bitnami - Applications générales
helm repo add bitnami https://charts.bitnami.com/bitnami

# Prometheus Community
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts

# Grafana
helm repo add grafana https://grafana.github.io/helm-charts

# Ingress NGINX
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

# Jetstack (cert-manager)
helm repo add jetstack https://charts.jetstack.io

# Elastic
helm repo add elastic https://helm.elastic.co

# HashiCorp
helm repo add hashicorp https://helm.releases.hashicorp.com

# AWS
helm repo add eks https://aws.github.io/eks-charts

# Mettre tout à jour
helm repo update

3.2 Artifact Hub

Artifact Hub is the central registry for finding charts.

# Recherche via CLI
helm search hub "database"

# Filtrer par organisation
helm search hub --list-repo-url "bitnami"

4 - Create an HTTP repository

4.1 With GitHub Pages

# 1. Créer un repo GitHub (ex: helm-charts)

# 2. Structure du repo
helm-charts/
├── charts/
│   ├── mon-app/
│   │   ├── Chart.yaml
│   │   ├── values.yaml
│   │   └── templates/
│   └── autre-app/
├── .github/
│   └── workflows/
│       └── release.yaml
└── README.md

# 3. Packager les charts
cd helm-charts
helm package charts/mon-app -d packages/
helm package charts/autre-app -d packages/

# 4. Générer l'index
helm repo index packages/ --url https://username.github.io/helm-charts

# 5. Publier sur GitHub Pages (branche gh-pages ou via Actions)

GitHub Action for automatic release:

# .github/workflows/release.yaml
name: Release Charts

on:
  push:
    branches:
      - main
    paths:
      - 'charts/**'

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "[email protected]"

      - name: Install Helm
        uses: azure/setup-helm@v3

      - name: Run chart-releaser
        uses: helm/chart-releaser-[email protected]
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

4.2 With ChartMuseum

# Démarrer ChartMuseum avec Docker
docker run -d \
  --name chartmuseum \
  -p 8080:8080 \
  -e DEBUG=1 \
  -e STORAGE=local \
  -e STORAGE_LOCAL_ROOTDIR=/charts \
  -v $(pwd)/charts:/charts \
  ghcr.io/helm/chartmuseum:latest

# Avec authentification basique
docker run -d \
  --name chartmuseum \
  -p 8080:8080 \
  -e BASIC_AUTH_USER=admin \
  -e BASIC_AUTH_PASS=password \
  -e STORAGE=local \
  -e STORAGE_LOCAL_ROOTDIR=/charts \
  -v $(pwd)/charts:/charts \
  ghcr.io/helm/chartmuseum:latest

# Ajouter le repo
helm repo add myrepo http://localhost:8080 --username admin --password password

# Push un chart (nécessite plugin helm-push)
helm plugin install https://github.com/chartmuseum/helm-push
helm cm-push mon-chart-1.0.0.tgz myrepo

4.3 With AWS S3

# Installer le plugin S3
helm plugin install https://github.com/hypnoglow/helm-s3.git

# Initialiser un bucket S3 comme repo
helm s3 init s3://mon-bucket/charts

# Ajouter le repo
helm repo add myrepo s3://mon-bucket/charts

# Push un chart
helm s3 push mon-chart-1.0.0.tgz myrepo

# Mettre à jour l'index
helm repo update myrepo

5 - OCI Registry

5.1 Concepts

Since Helm 3.8, OCI support is stable. Charts can be stored in container registries.

5.2 Basic usage

# Login au registry
helm registry login ghcr.io -u username
helm registry login docker.io -u username

# Push un chart
helm package ./mon-chart
helm push mon-chart-1.0.0.tgz oci://ghcr.io/monorg/charts

# Pull un chart
helm pull oci://ghcr.io/monorg/charts/mon-chart --version 1.0.0

# Installer directement depuis OCI
helm install myrelease oci://ghcr.io/monorg/charts/mon-chart --version 1.0.0

# Voir les tags disponibles
helm show all oci://ghcr.io/monorg/charts/mon-chart

5.3 GitHub Container Registry (GHCR)

# Créer un token avec scope: write:packages
# Login
echo $GITHUB_TOKEN | helm registry login ghcr.io -u USERNAME --password-stdin

# Push
helm push mon-chart-1.0.0.tgz oci://ghcr.io/USERNAME/charts

# Pull/Install
helm pull oci://ghcr.io/USERNAME/charts/mon-chart --version 1.0.0

GitHub Action for OCI push:

# .github/workflows/push-chart.yaml
name: Push Chart to GHCR

on:
  push:
    tags:
      - 'v*'

jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Helm
        uses: azure/setup-helm@v3
      
      - name: Login to GHCR
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
      
      - name: Package and Push
        run: |
          helm package ./charts/mon-chart
          helm push mon-chart-*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts

5.4 AWS ECR

# Login avec AWS CLI
aws ecr get-login-password --region eu-west-1 | helm registry login --username AWS --password-stdin 123456789.dkr.ecr.eu-west-1.amazonaws.com

# Créer un repository ECR pour les charts
aws ecr create-repository --repository-name helm-charts/mon-chart --region eu-west-1

# Push
helm push mon-chart-1.0.0.tgz oci://123456789.dkr.ecr.eu-west-1.amazonaws.com/helm-charts

# Pull
helm pull oci://123456789.dkr.ecr.eu-west-1.amazonaws.com/helm-charts/mon-chart --version 1.0.0

5.5 Azure Container Registry

# Login
az acr login --name myregistry
# ou
helm registry login myregistry.azurecr.io -u username -p password

# Push
helm push mon-chart-1.0.0.tgz oci://myregistry.azurecr.io/charts

# Pull
helm pull oci://myregistry.azurecr.io/charts/mon-chart --version 1.0.0

6 - Repository security

6.1 Authentication

# HTTP Basic Auth
helm repo add secure https://charts.example.com \
  --username admin \
  --password secret

# Certificat client
helm repo add secure https://charts.example.com \
  --cert-file /path/to/cert.pem \
  --key-file /path/to/key.pem \
  --ca-file /path/to/ca.pem

# Token Bearer
helm repo add secure https://charts.example.com \
  --pass-credentials

6.2 Chart signing (Provenance)

# Générer une clé GPG
gpg --quick-generate-key "John Doe <[email protected]>"

# Packager et signer
helm package ./mon-chart --sign --key "John Doe" --keyring ~/.gnupg/pubring.gpg

# Résultat: mon-chart-1.0.0.tgz + mon-chart-1.0.0.tgz.prov

# Vérifier la signature
helm verify mon-chart-1.0.0.tgz --keyring ~/.gnupg/pubring.gpg

# Installer avec vérification
helm install myrelease mon-chart-1.0.0.tgz --verify --keyring ~/.gnupg/pubring.gpg

7 - Mirror and proxy

7.1 Repository proxy

# ChartMuseum comme proxy
docker run -d \
  -p 8080:8080 \
  -e CHART_URL=https://charts.bitnami.com/bitnami \
  ghcr.io/helm/chartmuseum:latest

7.2 Local mirror

# Script pour mirror un repo
#!/bin/bash
REPO_URL="https://charts.bitnami.com/bitnami"
LOCAL_DIR="./mirror"

# Télécharger l'index
curl -o index.yaml "$REPO_URL/index.yaml"

# Extraire et télécharger les charts
for url in $(grep -oP 'https://[^"]+\.tgz' index.yaml); do
  wget -P "$LOCAL_DIR" "$url"
done

# Régénérer l'index
helm repo index "$LOCAL_DIR" --url http://localhost:8080

8 - Best practices

8.1 Organization

helm-charts-repo/
├── charts/
│   ├── app-frontend/
│   │   ├── Chart.yaml
│   │   └── ...
│   ├── app-backend/
│   │   ├── Chart.yaml
│   │   └── ...
│   └── common-library/
│       ├── Chart.yaml (type: library)
│       └── ...
├── scripts/
│   ├── lint.sh
│   ├── package.sh
│   └── test.sh
├── .github/workflows/
│   └── release.yaml
├── ct.yaml                 # Chart Testing config
└── README.md

8.2 Semantic versioning

# Chart.yaml
version: 1.2.3    # Version du chart (SemVer)
appVersion: "2.0" # Version de l'application

# Règles SemVer:
# MAJOR.MINOR.PATCH
# - MAJOR: Breaking changes
# - MINOR: Nouvelles fonctionnalités
# - PATCH: Bug fixes

8.3 CI/CD for charts

# ct.yaml (Chart Testing)
remote: origin
target-branch: main
chart-dirs:
  - charts
chart-repos:
  - bitnami=https://charts.bitnami.com/bitnami
helm-extra-args: --timeout 600s

# Linting
ct lint --config ct.yaml

# Test installation
ct install --config ct.yaml

Summary

In this chapter, we learned:

The different repository types (HTTP, OCI)
Managing repositories (add, update, remove)
Creating repositories (GitHub Pages, ChartMuseum, S3)
Using OCI registries (GHCR, ECR, ACR)
Security (authentication, signing)
Best practices for organization

Next step

In the next chapter, we will look at Release Management.

→ Next chapter: Release Management

← Back to the table of contents

1 - Repository types​

2 - Managing repositories​

2.1 Basic commands​

2.2 Search for charts​

3 - Popular public repositories​

3.1 Configuration​

3.2 Artifact Hub​

4 - Create an HTTP repository​

4.1 With GitHub Pages​

4.2 With ChartMuseum​

4.3 With AWS S3​

5 - OCI Registry​

5.1 Concepts​

5.2 Basic usage​

5.3 GitHub Container Registry (GHCR)​

5.4 AWS ECR​

5.5 Azure Container Registry​

6 - Repository security​

6.1 Authentication​

6.2 Chart signing (Provenance)​

7 - Mirror and proxy​

7.1 Repository proxy​

7.2 Local mirror​

8 - Best practices​

8.1 Organization​

8.2 Semantic versioning​

8.3 CI/CD for charts​

Summary​

Next step​