Helm chart repositories

Kubernetes Helm charts for helm repo add, install and pull, published with a PUT or helm cm-push

Helm repositories are classic chart repositories: an index.yaml and packaged charts, as helm repo add, helm search repo, helm install, helm pull and helm show expect, and as Argo CD and Flux read them. Hosted repositories take the charts you publish; proxy repositories cache Bitnami, a project's chart repository or another Depotex.

Charts kept in OCI registries (helm push oci://…, helm install oci://…) go in a Docker repository instead: an OCI chart is stored like an image.

1. Add the repository

helm repo add depotex https://depotex.example.com/repository/my-space/helm/ --username me --password "$DEPOTEX_TOKEN"
helm repo update
helm search repo depotex/
helm install demo depotex/my-chart --version 1.0.0

With a Helm group as the space's default, https://depotex.example.com/repository/my-space/helm/ lists the charts of every member in one index.yaml: your hosted charts and a proxy's.

2. Publish a chart

Package the chart, then upload it with Publish permission, either with a PUT of the file or as ChartMuseum and the helm-push plugin do (POST api/charts):

helm package ./my-chart
curl -f -u "me:$DEPOTEX_TOKEN" --upload-file my-chart-1.0.0.tgz https://depotex.example.com/repository/my-space/helm/my-chart-1.0.0.tgz

# or, with the helm-push plugin
helm cm-push my-chart-1.0.0.tgz depotex

The archive is checked: one top-level folder with a Chart.yaml (apiVersion v1 or v2, a name and a SemVer version), and its name and version must match the file name (my-chart-1.0.0.tgz).
A provenance file (my-chart-1.0.0.tgz.prov) uploaded next to the chart is served for helm verify and helm install --verify; with POST api/charts, send it in a form part named prov beside the chart part.
A version can't be replaced once published: every index that lists it pins its digest. New Helm repositories publish once.
index.yaml is generated from the charts published, with each version's digest, and can't be uploaded. Delete a version with DELETE api/charts/<name>/<version> (Delete permission), as ChartMuseum does.

3. Versions and policies

Each chart version is a version in Depotex: it shows in the Versions tab, and cleanup policies, quotas, quarantine and the block list apply to it.
Block-list ranges compare chart versions by semver, with or without a leading v.
Blocked versions are left out of index.yaml and their archives refused; quarantined versions too when the repository hides them.

4. Proxy repositories

Add an upstream with the Bitnami Helm charts preset (https://charts.bitnami.com/bitnami) or the address of any chart repository (the folder that holds its index.yaml), allow it for the space, then create a proxy repository with it. Its index.yaml is re-checked after the metadata age, and each chart is fetched from the address the index lists when first asked for, checked against the index's digest, and kept. helm pull works without a helm repo update first. A proxy can also reach a Helm repository of another Depotex (Depotex link).

Chart repositories often host their charts somewhere else, such as GitHub releases. Depotex fetches charts from the index's own server, or from another server only by host name over HTTPS: links to IP addresses, localhost or single-word host names are refused, so an index can't point Depotex at your internal network. The upstream's credentials are only sent to its own server.

5. In the artifact browser

Charts show by name, then their versions. The Install bar shows helm install for the version, and Registry setup shows helm pull.

6. Limits

Charts pushed with helm push oci://… live in a Docker repository and don't appear in a Helm repository's index.yaml: install them with helm install oci://…, and publish charts meant for helm repo add to a Helm repository.
Provenance files are stored and served, not checked: helm verify checks them on your side.
The browser doesn't show Chart.yaml details or chart dependencies yet.