Configuring custom Helm chart repositories

The Developer Catalog, in the Developer perspective of the web console, displays the Helm charts available in the cluster. By default, it lists the Helm charts from the Red Hat Helm chart repository. For a list of the charts see the Red Hat Helm index file.

As a cluster administrator, you can add multiple Helm chart repositories, apart from the default one, and display the Helm charts from these repositories in the Developer Catalog.

Adding custom Helm chart repositories

You can add custom Helm chart repositories to your cluster, and enable access to the Helm charts from these repositories in the Developer Catalog.

Procedure

  1. To add a new Helm Chart Repository, you must add the Helm Chart Repository custom resource (CR) to your cluster.

    Sample Helm Chart Repository CR

    1. apiVersion: helm.openshift.io/v1beta1
    2. kind: HelmChartRepository
    3. metadata:
    4.   name: <name>
    5. spec:
    6.  # optional name that might be used by console
    7.  # name: <chart-display-name>
    8.   connectionConfig:
    9.     url: <helm-chart-repository-url>

    For example, to add an Azure sample chart repository, run:

    1. $ cat <<EOF | oc apply -f -
    2. apiVersion: helm.openshift.io/v1beta1
    3. kind: HelmChartRepository
    4. metadata:
    5.   name: azure-sample-repo
    6. spec:
    7.   name: azure-sample-repo
    8.   connectionConfig:
    9.     url: https://raw.githubusercontent.com/Azure-Samples/helm-charts/master/docs
    10. EOF

  2. Navigate to the Developer Catalog in the web console to verify that the helm charts from the Azure chart repository are displayed.

Creating credentials and CA certificates to add Helm chart repositories

Some Helm chart repositories need credentials and custom certificate authority (CA) certificates to connect to it. You can use the web console as well as the CLI to add credentials and certificates.

Procedure

To configure the credentials and certificates, and then add a Helm chart repository using the CLI:

  1. In the openshift-config namespace, create a ConfigMap object with a custom CA certificate in PEM encoded format, and store it under the ca-bundle.crt key within the config map:

    1. $ oc create configmap helm-ca-cert \
    2. --from-file=ca-bundle.crt=/path/to/certs/ca.crt \
    3. -n openshift-config

  2. In the openshift-config namespace, create a Secret object to add the client TLS configurations:

    1. $ oc create secret generic helm-tls-configs \
    2. --from-file=tls.crt=/path/to/certs/client.crt \
    3. --from-file=tls.key=/path/to/certs//client.key \
    4. -n openshift-config

    Note that the client certificate and key must be in PEM encoded format and stored under the keys tls.crt and tls.key, respectively.

  3. Add the Helm repository as follows:

    1. $ cat <<EOF | oc apply -f -
    2. apiVersion: helm.openshift.io/v1beta1
    3. kind: HelmChartRepository
    4. metadata:
    5.   name: <helm-repository>
    6. spec:
    7.   name: <helm-repository>
    8.   connectionConfig:
    9.     url: <URL for the Helm repository>
    10.     tlsConfig:
    11.         name: helm-tls-configs
    12.     ca:
    13.     name: helm-ca-cert
    14. EOF

    The ConfigMap and Secret are consumed in the HelmChartRepository CR using the tlsConfig and ca fields. These certificates are used to connect to the Helm repository URL.

  4. By default, all authenticated users have access to all configured charts. However, for chart repositories where certificates are needed, you must provide users with read access to the helm-ca-cert config map and helm-tls-configs secret in the openshift-config namespace, as follows:

    1. $ cat <<EOF | kubectl apply -f -
    2. apiVersion: rbac.authorization.k8s.io/v1
    3. kind: Role
    4. metadata:
    5.   namespace: openshift-config
    6.   name: helm-chartrepos-tls-conf-viewer
    7. rules:
    8. - apiGroups: [""]
    9.   resources: ["configmaps"]
    10.   resourceNames: ["helm-ca-cert"]
    11.   verbs: ["get"]
    12. - apiGroups: [""]
    13.   resources: ["secrets"]
    14.   resourceNames: ["helm-tls-configs"]
    15.   verbs: ["get"]
    16. ---
    17. kind: RoleBinding
    18. apiVersion: rbac.authorization.k8s.io/v1
    19. metadata:
    20.   namespace: openshift-config
    21.   name: helm-chartrepos-tls-conf-viewer
    22. subjects:
    23.   - kind: Group
    24.     apiGroup: rbac.authorization.k8s.io
    25.     name: 'system:authenticated'
    26. roleRef:
    27.   apiGroup: rbac.authorization.k8s.io
    28.   kind: Role
    29.   name: helm-chartrepos-tls-conf-viewer
    30. EOF