Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using oci:// prefix in repository errors with not valid chart error #10823

Open
3 tasks done
LukasAuerbeck opened this issue Oct 6, 2022 · 12 comments
Open
3 tasks done
Labels
bug Something isn't working component:config-management Tools specific issues (helm, kustomize etc)

Comments

@LukasAuerbeck
Copy link

Checklist:

  • I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
  • I've included steps to reproduce the bug.
  • I've pasted the output of argocd version.

Describe the bug

When trying to declaratively deploy a repository that is prefixed with oci://, argocd/helm can't pull the chart and errors with:

Error: looks like \"oci://gcr.io/renovate-oci-demo/chart\" is not a valid chart repository or cannot be reached: object required

There are also a few existing issues regarding OCI behaviour, however, I didn't find one that has the same error messages/error behaviour.

To Reproduce

Application spec that causes deployment errors:

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: renovate-oci-demo
spec:
  project: default
  source:
    chart: renovate-oci-demo
    repoURL: oci://gcr.io/renovate-oci-demo/chart
    targetRevision: 1.0.0
  destination:
    server: "https://kubernetes.default.svc"
    namespace: renovate-oci-demo
  syncPolicy:
    automated: {}
    syncOptions:
      - CreateNamespace=true

Application spec that deploys and has no errors in argocd, but has application errors due to being only a demo chart:

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: renovate-oci-demo
spec:
  project: default
  source:
    chart: renovate-oci-demo
    repoURL: gcr.io/renovate-oci-demo/chart
    targetRevision: 1.0.0
  destination:
    server: "https://kubernetes.default.svc"
    namespace: renovate-oci-demo
  syncPolicy:
    automated: {}
    syncOptions:
      - CreateNamespace=true

The difference between the two specs seems to be the generated helm pull command, since manually running them errors the same way.

Failing pull command from application with oci:// prefix:

helm pull --destination /tmp/e99bb6c1-5769-4115-ae13-e8255ae32821 --version 1.0.0 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo

Working pull command from application without oci:// prefix:

helm pull oci://gcr.io/renovate-oci-demo/chart/renovate-oci-demo --version 1.0.1 --destination /tmp/1185a1dc-a23e-421f-b8f0-8326745109dd

Expected behavior

Adding/removing the oci:// prefix should not make a difference. Especially because the implicit definition is supported, while the explicit definition errors.

Screenshots

Version

argocd: v2.4.12+41f54aa.dirty
  BuildDate: 2022-09-16T03:19:53Z
  GitCommit: 41f54aa556f3ffb3fa4cf93d784fb7d30c15041c
  GitTreeState: dirty
  GoVersion: go1.19.1
  Compiler: gc
  Platform: darwin/amd64
argocd-server: v2.4.13+19ec34e

Logs

argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Refreshing app status (normal refresh requested), level (3)" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore status for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore '/spec/preserveUnknownFields' for CustomResourceDefinitions"
argocd-server-5b66566ddb-9zd5g server time="2022-10-06T08:51:36Z" level=info msg="Requested app 'renovate-oci-demo' refresh"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Comparing app state (cluster: https://kubernetes.default.svc, namespace: renovate-oci-demo)" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore status for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore '/spec/preserveUnknownFields' for CustomResourceDefinitions"
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Start processing" resource=argocd/renovate-oci-demo
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Processing completed" resource=argocd/renovate-oci-demo
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="manifest cache miss: &ApplicationSource{RepoURL:oci://gcr.io/renovate-oci-demo/chart,Path:,TargetRevision:1.0.1,Helm:nil,Kustomize:nil,Directory:nil,Plugin:nil,Chart:renovate-oci-demo,}/1.0.1"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="helm pull --destination /tmp/e99bb6c1-5769-4115-ae13-e8255ae32821 --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo" dir= execID=948fe
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="manifest cache hit: &ApplicationSource{RepoURL:https://<gitlab-url>,Path:<gitlab-project>,TargetRevision:HEAD,Helm:nil,Kustomize:nil,Directory:nil,Plugin:nil,Chart:,}/fc31577192eccfdd63f7363ece4a7b89a6717dcd"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GenerateManifest grpc.service=repository.RepoServerService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=2.684 span.kind=server system=grpc
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=error msg="`helm pull --destination /tmp/e99bb6c1-5769-4115-ae13-e8255ae32821 --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo` failed exit status 1: Error: looks like \"oci://gcr.io/renovate-oci-demo/chart\" is not a valid chart repository or cannot be reached: object required" execID=948fe
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg=Trace args="[helm pull --destination /tmp/e99bb6c1-5769-4115-ae13-e8255ae32821 --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo]" dir= operation_name="exec helm" time_ms=28.850208
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=error msg="finished unary call with code Unknown" error="`helm pull --destination /tmp/e99bb6c1-5769-4115-ae13-e8255ae32821 --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo` failed exit status 1: Error: looks like \"oci://gcr.io/renovate-oci-demo/chart\" is not a valid chart repository or cannot be reached: object required" grpc.code=Unknown grpc.method=GenerateManifest grpc.service=repository.RepoServerService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=30.665 span.kind=server system=grpc
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Start processing" resource=argocd/renovate-oci-demo
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Processing completed" resource=argocd/renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore status for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore '/spec/preserveUnknownFields' for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Normalized app spec: {\"status\":{\"conditions\":[{\"lastTransitionTime\":\"2022-10-06T08:51:36Z\",\"message\":\"rpc error: code = Unknown desc = `helm pull --destination /tmp/e99bb6c1-5769-4115-ae13-e8255ae32821 --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo` failed exit status 1: Error: looks like \\\"oci://gcr.io/renovate-oci-demo/chart\\\" is not a valid chart repository or cannot be reached: object required\",\"type\":\"ComparisonError\"}]}}" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Skipping auto-sync: application status is Unknown" application=renovate-oci-demo
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="manifest cache hit: &ApplicationSource{RepoURL:https://<gitlab-url>,Path:<gitlab-project>,TargetRevision:HEAD,Helm:nil,Kustomize:nil,Directory:nil,Plugin:nil,Chart:,}/fc31577192eccfdd63f7363ece4a7b89a6717dcd"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GenerateManifest grpc.service=repository.RepoServerService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=1.876 span.kind=server system=grpc
argocd-server-5b66566ddb-9zd5g server time="2022-10-06T08:51:36Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Get grpc.service=application.ApplicationService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=116.688 span.kind=server system=grpc
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Update successful" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Reconciliation completed" application=renovate-oci-demo dedup_ms=0 dest-name= dest-namespace=renovate-oci-demo dest-server="https://kubernetes.default.svc" diff_ms=4 fields.level=3 git_ms=42 health_ms=0 live_ms=0 settings_ms=0 sync_ms=0 time_ms=87
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Start processing" resource=argocd/renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Refreshing app status (normal refresh requested), level (3)" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore status for CustomResourceDefinitions"
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Processing completed" resource=argocd/renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore '/spec/preserveUnknownFields' for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Comparing app state (cluster: https://kubernetes.default.svc, namespace: renovate-oci-demo)" application=renovate-oci-demo
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="manifest cache miss: &ApplicationSource{RepoURL:oci://gcr.io/renovate-oci-demo/chart,Path:,TargetRevision:1.0.1,Helm:nil,Kustomize:nil,Directory:nil,Plugin:nil,Chart:renovate-oci-demo,}/1.0.1"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="helm pull --destination /tmp/410f9cab-9dd0-4252-9b7b-dc5b5afc339b --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo" dir= execID=5bd18
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=error msg="`helm pull --destination /tmp/410f9cab-9dd0-4252-9b7b-dc5b5afc339b --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo` failed exit status 1: Error: looks like \"oci://gcr.io/renovate-oci-demo/chart\" is not a valid chart repository or cannot be reached: object required" execID=5bd18
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg=Trace args="[helm pull --destination /tmp/410f9cab-9dd0-4252-9b7b-dc5b5afc339b --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo]" dir= operation_name="exec helm" time_ms=38.715986
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=error msg="finished unary call with code Unknown" error="`helm pull --destination /tmp/410f9cab-9dd0-4252-9b7b-dc5b5afc339b --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo` failed exit status 1: Error: looks like \"oci://gcr.io/renovate-oci-demo/chart\" is not a valid chart repository or cannot be reached: object required" grpc.code=Unknown grpc.method=GenerateManifest grpc.service=repository.RepoServerService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=40.444 span.kind=server system=grpc
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore status for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore '/spec/preserveUnknownFields' for CustomResourceDefinitions"
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Start processing" resource=argocd/renovate-oci-demo
argocd-notifications-controller-84cd4ddd94-btfgl notifications-controller time="2022-10-06T08:51:36Z" level=info msg="Processing completed" resource=argocd/renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Normalized app spec: {\"status\":{\"conditions\":[{\"lastTransitionTime\":\"2022-10-06T08:51:36Z\",\"message\":\"rpc error: code = Unknown desc = `helm pull --destination /tmp/410f9cab-9dd0-4252-9b7b-dc5b5afc339b --version 1.0.1 --repo oci://gcr.io/renovate-oci-demo/chart renovate-oci-demo` failed exit status 1: Error: looks like \\\"oci://gcr.io/renovate-oci-demo/chart\\\" is not a valid chart repository or cannot be reached: object required\",\"type\":\"ComparisonError\"}]}}" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Skipping auto-sync: application status is Unknown" application=renovate-oci-demo
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="manifest cache hit: &ApplicationSource{RepoURL:https://<gitlab-url>,Path:<gitlab-project>,TargetRevision:HEAD,Helm:nil,Kustomize:nil,Directory:nil,Plugin:nil,Chart:,}/fc31577192eccfdd63f7363ece4a7b89a6717dcd"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GenerateManifest grpc.service=repository.RepoServerService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=2.866 span.kind=server system=grpc
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Update successful" application=renovate-oci-demo
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Reconciliation completed" application=renovate-oci-demo dedup_ms=0 dest-name= dest-namespace=renovate-oci-demo dest-server="https://kubernetes.default.svc" diff_ms=2 fields.level=3 git_ms=54 health_ms=0 live_ms=0 settings_ms=7 sync_ms=0 time_ms=90
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore status for CustomResourceDefinitions"
argocd-application-controller-0 application-controller time="2022-10-06T08:51:36Z" level=info msg="Ignore '/spec/preserveUnknownFields' for CustomResourceDefinitions"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="manifest cache hit: &ApplicationSource{RepoURL:https://<gitlab-url>,Path:<gitlab-project>,TargetRevision:HEAD,Helm:nil,Kustomize:nil,Directory:nil,Plugin:nil,Chart:,}/fc31577192eccfdd63f7363ece4a7b89a6717dcd"
argocd-repo-server-57bb89968b-ggdzl repo-server time="2022-10-06T08:51:36Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GenerateManifest grpc.service=repository.RepoServerService grpc.start_time="2022-10-06T08:51:36Z" grpc.time_ms=1.787 span.kind=server system=grpc
@LukasAuerbeck LukasAuerbeck added the bug Something isn't working label Oct 6, 2022
@jgwest jgwest added component:core Syncing, diffing, cluster state cache component:config-management Tools specific issues (helm, kustomize etc) and removed component:core Syncing, diffing, cluster state cache labels Oct 7, 2022
@bramamad
Copy link

bramamad commented Jan 6, 2023

I got the same error:

rpc error: code = Unknown desc = helm pull --destination /tmp/0a20c7e4-ffba-4218-9073-35ce3a0038a1 --version 1.0.0 --repo oci://harbor.bkw.ch/bkw-helmcharts/individual-app failed exit status 1: Error: looks like "oci://harbor.bkw.ch/bkw-helmcharts/individual-app" is not a valid chart repository or cannot be reached: object required

I checked the original helm pull command. Gives the same error:
helm pull --destination /tmp/ --version 1.0.0 --repo oci://harbor.bkw.ch/bkw-helmcharts/individual-app
Error: looks like "oci://harbor.bkw.ch/bkw-helmcharts/individual-app" is not a valid chart repository or cannot be reached: object required

After that the same but without the --repo clause and directly with the correct oci url:
helm pull --destination /tmp/0a20c7e4-ffba-4218-9073-35ce3a0038a1 --version 1.0.0 oci://harbor.bkw.ch/bkw-helmcharts/individual-app

So the problem is not the oci:// prefix; it is the --repo clause that is not supported. Isn't it ?

@dllegru
Copy link

dllegru commented Jan 6, 2023

I run into the same error, managed to workaround it by splitting & moving the source.repoURL chart path into the source.chart, leaving just the domain name.

For example using the orignal posted error would look like the following::

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: renovate-oci-demo
spec:
  project: default
  source:
    chart: renovate-oci-demo/chartrenovate-oci-demo
    repoURL: oci://gcr.io
    targetRevision: 1.0.0
  destination:
    server: "https://kubernetes.default.svc"
    namespace: renovate-oci-demo
  syncPolicy:
    automated: {}
    syncOptions:
      - CreateNamespace=true

Give it a go, that fixed it for me.

Update: Was reviewing my config and I'm not using it exactly as described, as I've a private oci credentials configured in Argo CD with enableOCI: true, so I'm using repoURL without the oci:// and stright the domain name (Argo then knows is a oci as is defined in the repository credentials config)
So it is not the same exact case, but was having the same error as described and fixed splitting it, hope it works for your case too.

@cloudymax
Copy link

This is also breaking using Bitnami's helm charts as they migrate to OCI spec.

As far as I can find, there isn't a way to use their public oci images through argo at all.

Adding the repo

argocd repo add registry-1.docker.io/bitnamicharts/keycloak \
  --type helm \
  --name keycloak \
  --enable-oci

Result

Repository 'registry-1.docker.io/bitnamicharts/keycloak' added

Try to create an app

argocd app create keycloak \
  --repo registry-1.docker.io/bitnamicharts/keycloak \
  --helm-chart keycloak --revision 1 \
  --dest-namespace keycloak \
  --dest-server https://kubernetes.default.svc  \
  --sync-policy auto 

Result

FATA[0000] rpc error: code = InvalidArgument desc = application spec for keycloak is invalid: InvalidSpecError: Unable to generate manifests in : rpc error: code = Unknown desc = helm pull oci://registry-1.docker.io/bitnamicharts/keycloak/keycloak --version 5.1.6 --destination /tmp/e404ed85-30e4-491a-b2e4-7155567cb4b2 failed exit status 1: Error: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

Cannot be created via the UI

Screenshot 2023-07-01 at 16 55 52

Apply via helm

helm install my-release oci://registry-1.docker.io/bitnamicharts/keycloak

Result

Pulled: registry-1.docker.io/bitnamicharts/keycloak:15.1.6
Digest: sha256:5cd521dab98750755724def06d7ae572769a16a0acab3726ff9c1aa4d58aeb64
NAME: my-release
LAST DEPLOYED: Sat Jul 1 16:35:39 2023
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
CHART NAME: keycloak
CHART VERSION: 15.1.6
APP VERSION: 21.1.2

@jessebot
Copy link
Contributor

jessebot commented Jul 4, 2023

@cloudymax, I got it working with the following:

# leave off the chart part when creating the repo
argocd repo add registry-1.docker.io \
  --type helm \
  --name docker \
  --enable-oci

# specify the full path to the chart and set the revision to one listed here:
# https://github.com/bitnami/charts/blob/main/bitnami/keycloak/Chart.yaml#L31C10-L31C16
argocd app create keycloak \
  --repo registry-1.docker.io \
  --helm-chart /bitnamicharts/keycloak --revision 15.1.6 \
  --dest-namespace keycloak \
  --dest-server https://kubernetes.default.svc  \
  --sync-policy auto 

@pcheliniy
Copy link

In case that someone want to use OCI repos and configure it in declarative way via official chart (https://argoproj.github.io/argo-helm) there is an example which works for our installation.
Our current chart version 5.36.6 and argo 2.7.6

values.yaml

....
configs:
  repositories:
    docker-registry:
      url: registry-1.docker.io
      username: "docker"
      password: ""
      name: docker-registry
      enableOCI: "true"
      type: "helm"

application.yaml

...
spec:
  sources:
    - repoURL: registry-1.docker.io
      chart: bitnamicharts/clickhouse
      targetRevision: 3.3.1
...

@azhurbilo
Copy link

  • argocd: 2.5.6
  • and we use Google Artifact Registry

in argocd config we have

configs:
  repositories:
    helm-registry:
      ## failed when set oci:// prefix
      url: asia-northeast1-docker.pkg.dev/myreponame/yyyyy
      name: argocd-repo-helm-registry
      enableOCI: "true"
      type: "helm"
      username: "_json_key"
      password: |
        {
        "type": "service_account",
        ...
        }

repo created successfully with success connection

but if we want reuse helm as dependancy in Chart.yaml (oci:// required here)

apiVersion: v2
appVersion: 1.16.0
dependencies:
 - name: backend
   repository: oci://asia-docker.pkg.dev/myreponame/yyyyy
   version: v0.1.7
name: xxxx
type: application
version: 2023.7.0

I receive error in Argocd

rpc error: code = Unknown desc = Manifest generation error (cached): helm dependency build failed exit status 1: Error: could not download oci://myreponame/yyyyy/backend: failed to authorize: failed to fetch anonymous token: unexpected status: 403 Forbidden

@FernandoMiguel
Copy link

@azhurbilo is this what you are seeing? #14636

@clouedoc
Copy link

clouedoc commented Nov 6, 2023

Here is what worked for me

Step 1 - Add a repository

argocd repo add ghcr.io --type helm --name stable --enable-oci

Step 2 - Create your Application file

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: operator-lifecycle-manager
  namespace: argocd
spec:
  project: default
  source:
    chart: cloudtooling/helm-charts/olm
    repoURL: ghcr.io
    targetRevision: 0.26.0
    helm:
      releaseName: olm
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
  destination:
    server: 'https://kubernetes.default.svc'
    namespace: infra

@DPatrickBoyd
Copy link

DPatrickBoyd commented Nov 8, 2023

adding in my set up in case it helps anyone. Here is my oci helm chart only:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: arc-system
  namespace: argocd
spec:
  project: arc
  destination:
    server: https://kubernetes.default.svc
    namespace: arc-system
  sources:
    - chart: actions/actions-runner-controller-charts/gha-runner-scale-set-controller
      repoURL: ghcr.io
      targetRevision: 0.6.1
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
      allowEmpty: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true

Here is local values.yaml with remote oci chart

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: appset-core
  namespace: argocd
spec:
  generators:
  - git:
      repoURL: 'https://github.com/org/repo.git'
      revision: HEAD
      files:
      - path: "github/ARC/groups/core/*/values.yaml"
  template:
    metadata:
      name: 'core-{{ path.basename }}'
    spec:
      destination:
        namespace: 'core-{{ path.basename }}'
        server: https://kubernetes.default.svc
      project: arc
      sources:
        - chart: actions/actions-runner-controller-charts/gha-runner-scale-set
          repoURL: ghcr.io
          targetRevision: 0.6.1
          helm:
            valueFiles:
            - $values/github/ARC/groups/core/{{ path.basename }}/values.yaml
        - repoURL: 'https://github.com/org/repo.git'
          targetRevision: HEAD
          ref: values
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
        - Replace=true
        - CreateNamespace=true

This is for a very specific type of resource, but the helm valueFiles with the local repo are the only thing that worked for me

@gaalw
Copy link

gaalw commented Nov 26, 2023

I also like to have oci:// prefix working to make interoperability with fluxcd and other systems.

@glyhood
Copy link

glyhood commented Feb 15, 2024

I run into the same error, managed to workaround it by splitting & moving the source.repoURL chart path into the source.chart, leaving just the domain name.

For example using the orignal posted error would look like the following::

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: renovate-oci-demo
spec:
  project: default
  source:
    chart: renovate-oci-demo/chartrenovate-oci-demo
    repoURL: oci://gcr.io
    targetRevision: 1.0.0
  destination:
    server: "https://kubernetes.default.svc"
    namespace: renovate-oci-demo
  syncPolicy:
    automated: {}
    syncOptions:
      - CreateNamespace=true

Give it a go, that fixed it for me.

Update: Was reviewing my config and I'm not using it exactly as described, as I've a private oci credentials configured in Argo CD with enableOCI: true, so I'm using repoURL without the oci:// and stright the domain name (Argo then knows is a oci as is defined in the repository credentials config) So it is not the same exact case, but was having the same error as described and fixed splitting it, hope it works for your case too.

this fixed it for me

@plsnotracking
Copy link

I looked at the solution provided here, here, and here, and seemingly I'm still struggling.

Here's what I've done so far.

Step 1: add repository

File: argocd-oci.yaml

apiVersion: v1
kind: Secret
metadata:
  labels:
    argocd.argoproj.io/secret-type: repository
  name: docker
  namespace: argocd
stringData:
  url: registry-1.docker.io
  name: docker
  type: helm
  enableOCI: "true"

Command to apply: kubectl apply -f argocd-oci.yaml -n argocd

I see the repo being successfully connected to
image

Step 2:

Create argocd mariadb app

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: mariadb
  namespace: argocd
spec:
  destination:
    namespace: mariadb
    name: enterprise
  project: default
  sources:
    # Values from Git
    - repoURL: 'https://git.enterprise.com/enterprise/argocd'
      targetRevision: HEAD
      ref: values
    # Chart from Chart Repo
    - chart: /bitnamicharts/mariadb
      repoUrl: registry-1.docker.io
      targetRevision: 17.0.1
      helm:
        valueFiles:
        - $values/enterprise/mariadb/values.yaml
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

Step 3. Additionally I tried to add the repo manually by hopping onto the pod but ran into a different issue

> argocd@argocd-server-b8bd4f4b5-b4tww:~$ argocd repo add oci://registry-1.docker.io/bitnamicharts --type helm --name stable --enable-oci --server 10.43.185.43

FATA[0000] Failed to establish connection to 10.43.185.43:443: dial tcp 10.43.185.43:443: connect: connection refused

Any assistance will be greatly appreciated. Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working component:config-management Tools specific issues (helm, kustomize etc)
Projects
None yet
Development

No branches or pull requests