OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates #15607

martinszuc · 2025-10-14T20:39:18Z

OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates

Fixes: https://issues.redhat.com/browse/OCPBUGS-44235

Problem

Helm chart installation fails when CA certificates or client TLS certificates are configured:

error locating chart: open /.cache/helm/repository/<hash>-index.yaml: no such file or directory

Browsing works. Installing fails.

Root Cause

Console uses Kubernetes CRDs for repository management, not Helm's repository cache. The code set chartPathOptions.RepoURL during authentication, forcing Helm to look for a cache at $HOME/.cache/helm/repository/. This cache doesn't exist in the console pod's read-only filesystem.

Solution

Remove chartPathOptions.RepoURL assignments. Helm downloads directly from URLs using CaFile, CertFile, and KeyFile without requiring repository cache.

Reproduction

See: https://github.com/openshift-helm/test-scenarios/tree/main/ca-certificate-test

openshift-ci-robot · 2025-10-14T20:39:23Z

@martinszuc: This pull request references Jira Issue OCPBUGS-44235, which is invalid:

expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates

Fixes: https://issues.redhat.com/browse/OCPBUGS-44235

Problem

Helm chart installation fails when CA certificates or client TLS certificates are configured:
error locating chart: open /.cache/helm/repository/<hash>-index.yaml: no such file or directory
Browsing works. Installing fails.

Root Cause

Console uses Kubernetes CRDs for repository management, not Helm's repository cache. The code set chartPathOptions.RepoURL during authentication, forcing Helm to look for a cache at $HOME/.cache/helm/repository/. This cache doesn't exist in the console pod's read-only filesystem.

Solution

Remove chartPathOptions.RepoURL assignments. Helm downloads directly from URLs using CaFile, CertFile, and KeyFile without requiring repository cache.

Reproduction

See: https://github.com/openshift-helm/OCPBUGS-44235

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-10-14T20:42:32Z

Hi @martinszuc. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

baijum · 2025-10-15T04:26:27Z

/ok-to-test

vikram-raj · 2025-10-16T09:38:46Z

/retest

Console uses Kubernetes CRDs to manage Helm repositories, not Helm's repository cache. Setting chartPathOptions.RepoURL forced Helm to look for a cache that doesn't exist in the console pod's read-only filesystem. Remove RepoURL assignments and use direct URL downloads with CaFile, CertFile, and KeyFile for authentication. Fixes https://issues.redhat.com/browse/OCPBUGS-44235 Signed-off-by: Martin Szuc <mszuc@redhat.com>

Test that authentication setup does not set RepoURL and verify chart downloads work with CA/TLS certificates. Signed-off-by: Martin Szuc <mszuc@redhat.com>

vikram-raj · 2025-10-16T13:11:46Z

/jira refresh

/cc @jhadvig

openshift-ci-robot · 2025-10-16T13:11:56Z

@vikram-raj: This pull request references Jira Issue OCPBUGS-44235, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

/cc @jhadvig

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

baijum · 2025-10-17T06:14:29Z

/lgtm

baijum · 2025-10-17T06:16:52Z

/hold

openshift-ci-robot · 2025-10-21T14:57:04Z

@martinszuc: This pull request references Jira Issue OCPBUGS-44235, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates

Fixes: https://issues.redhat.com/browse/OCPBUGS-44235

Problem

Helm chart installation fails when CA certificates or client TLS certificates are configured:
error locating chart: open /.cache/helm/repository/<hash>-index.yaml: no such file or directory
Browsing works. Installing fails.

Root Cause

Console uses Kubernetes CRDs for repository management, not Helm's repository cache. The code set chartPathOptions.RepoURL during authentication, forcing Helm to look for a cache at $HOME/.cache/helm/repository/. This cache doesn't exist in the console pod's read-only filesystem.

Solution

Remove chartPathOptions.RepoURL assignments. Helm downloads directly from URLs using CaFile, CertFile, and KeyFile without requiring repository cache.

Reproduction

See: https://github.com/openshift-helm/test-scenarios/tree/test/ca-cert-server/ca-certificate-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

baijum · 2025-10-28T12:10:35Z

/retest

jhadvig

Thank you @martinszuc 👍 Change looks good ✌️
/hold cancel

openshift-ci · 2025-11-03T14:15:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: baijum, jhadvig, martinszuc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~pkg/helm/OWNERS~~ [baijum,jhadvig]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

baijum · 2025-11-04T15:31:47Z

/verified by @baijum

openshift-ci-robot · 2025-11-04T15:32:02Z

@baijum: This PR has been marked as verified by @baijum.

Details

In response to this:

/verified by @baijum

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-11-05T03:09:06Z

@martinszuc: Jira Issue Verification Checks: Jira Issue OCPBUGS-44235
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-44235 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates

Fixes: https://issues.redhat.com/browse/OCPBUGS-44235

Problem

Helm chart installation fails when CA certificates or client TLS certificates are configured:
error locating chart: open /.cache/helm/repository/<hash>-index.yaml: no such file or directory
Browsing works. Installing fails.

Root Cause

Console uses Kubernetes CRDs for repository management, not Helm's repository cache. The code set chartPathOptions.RepoURL during authentication, forcing Helm to look for a cache at $HOME/.cache/helm/repository/. This cache doesn't exist in the console pod's read-only filesystem.

Solution

Remove chartPathOptions.RepoURL assignments. Helm downloads directly from URLs using CaFile, CertFile, and KeyFile without requiring repository cache.

Reproduction

See: https://github.com/openshift-helm/test-scenarios/tree/main/ca-certificate-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2025-11-06T07:16:16Z

Fix included in accepted release 4.21.0-0.nightly-2025-11-05-234508

martinszuc · 2025-12-18T01:52:55Z

/cherrypick release-4.18

openshift-cherrypick-robot · 2025-12-18T01:54:06Z

@martinszuc: new pull request created: #15860

Details

In response to this:

/cherrypick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

martinszuc · 2025-12-18T01:56:23Z

/cherrypick release-4.19

openshift-cherrypick-robot · 2025-12-18T01:57:07Z

@martinszuc: new pull request created: #15861

Details

In response to this:

/cherrypick release-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

martinszuc · 2025-12-18T02:13:23Z

/cherrypick release-4.20

openshift-cherrypick-robot · 2025-12-18T02:14:07Z

@martinszuc: new pull request created: #15862

Details

In response to this:

/cherrypick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 14, 2025

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Oct 14, 2025

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. component/backend Related to backend needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 14, 2025

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 15, 2025

martinszuc added 2 commits October 16, 2025 12:10

OCPBUGS-44235: Add tests for fix

aed7a1e

Test that authentication setup does not set RepoURL and verify chart downloads work with CA/TLS certificates. Signed-off-by: Martin Szuc <mszuc@redhat.com>

martinszuc force-pushed the ocpbugs-44235-fix branch from d83db26 to aed7a1e Compare October 16, 2025 10:11

martinszuc marked this pull request as ready for review October 16, 2025 13:01

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 16, 2025

openshift-ci bot requested review from Leo6Leo and baijum October 16, 2025 13:02

openshift-ci bot requested a review from jhadvig October 16, 2025 13:11

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 16, 2025

openshift-ci bot assigned baijum Oct 17, 2025

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 17, 2025

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 17, 2025

jhadvig approved these changes Nov 3, 2025

View reviewed changes

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 3, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 4, 2025

This comment was marked as outdated.

Sign in to view

openshift-merge-bot bot merged commit 0b7b101 into openshift:main Nov 5, 2025
7 of 8 checks passed

openshift-cherrypick-robot mentioned this pull request Dec 18, 2025

[release-4.18] OCPBUGS-69729: Fix Helm chart installation with CA/TLS certificates #15860

Closed

openshift-cherrypick-robot mentioned this pull request Dec 18, 2025

[release-4.19] OCPBUGS-69730: Fix Helm chart installation with CA/TLS certificates #15861

Closed

openshift-cherrypick-robot mentioned this pull request Dec 18, 2025

[release-4.20] OCPBUGS-69732: Fix Helm chart installation with CA/TLS certificates #15862

Open

OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates #15607

OCPBUGS-44235: Fix Helm chart installation with CA/TLS certificates #15607

Uh oh!

Conversation

martinszuc commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!