Keep Helm repository credentials on their configured origin

Author: hisco

docs/helm.md

@@ -153,6 +153,14 @@ Programmatic upgrades require a confirmed saved source or an explicit source sel
 
 Explicit source changes use `POST /api/helm/releases/{namespace}/{name}/source/preview`, followed by `/source/upgrade` or `/source/upgrade-stream`. These routes require the `sourceUpgrade` selection, explicit values and an exact version (body `version` for preview, query `version` for upgrade). Preview returns `previewDigest`; send it back in the selection when applying. The selection also carries `expectedRevision` and `expectedSource` from source status. Older backends return 404 for these routes instead of ignoring the selected source. Ordinary upgrade routes reject source-change fields.
 
+### Repository credentials and redirects
+
+For HTTP repositories, Radar sends repository passwords and client certificates only to the configured address's scheme, hostname and port. A redirect or a chart URL on another origin is fetched without those credentials by default. Public chart hosts are fetched without repository credentials. By default, on a different origin, Radar verifies the server certificate using system trust plus any configured CA, even if verification was skipped for the repository.
+
+If a private repository deliberately shares credentials with its chart host, its Helm configuration must explicitly enable `pass_credentials_all`. This also permits sending the client certificate to that host. Use it only for hosts you trust. Redirected Basic authentication still follows Go's hostname restrictions; Radar does not restore a header Go removed.
+
+Custom CA certificates, client certificates and `insecure_skip_tls_verify` remain supported, including configurations with both a CA file and skipped certificate verification. If a repository address redirects from HTTP to HTTPS, configure its final HTTPS address to keep authenticated requests on the configured origin.
+
 ### Chart download checksums
 
 When an HTTP repository index advertises a SHA-256 checksum, Radar checks the downloaded chart archive before reading or using it. An invalid checksum or a mismatch stops chart details, installation, source recording and any upgrade or values operation that downloads that chart. The release stays unchanged.

internal/helm/chart_sources.go

@@ -16,7 +16,6 @@ import (
 	"strings"
 
 	"helm.sh/helm/v3/pkg/action"
-	"helm.sh/helm/v3/pkg/getter"
 	"helm.sh/helm/v3/pkg/release"
 	"helm.sh/helm/v3/pkg/repo"
 	orasregistry "oras.land/oras-go/v2/registry"
@@ -347,7 +346,7 @@ func (c *Client) ensureClassicRepository(rawURL, preferredName string) (string,
 		return "", fmt.Errorf("stage repository index: %w", err)
 	}
 	defer os.RemoveAll(stageDir)
-	chartRepo, err := repo.NewChartRepository(entry, getter.All(c.settings))
+	chartRepo, err := repo.NewChartRepository(entry, c.repositoryGetters(entry))
 	if err != nil {
 		return "", fmt.Errorf("failed to create chart repository: %w", err)
 	}

internal/helm/client.go

@@ -35,7 +35,6 @@ import (
 	"helm.sh/helm/v3/pkg/chart/loader"
 	"helm.sh/helm/v3/pkg/chartutil"
 	"helm.sh/helm/v3/pkg/cli"
-	"helm.sh/helm/v3/pkg/getter"
 	"helm.sh/helm/v3/pkg/kube"
 	"helm.sh/helm/v3/pkg/registry"
 	"helm.sh/helm/v3/pkg/release"
@@ -60,6 +59,16 @@ var repositoryRefreshErrorURL = regexp.MustCompile(`[a-zA-Z][a-zA-Z0-9+.-]*://[^
 
 // HTTP client for ArtifactHub requests
 var httpClient = &http.Client{
+	CheckRedirect: func(req *http.Request, via []*http.Request) error {
+		if len(via) >= 10 {
+			return fmt.Errorf("stopped after 10 redirects")
+		}
+		if !sameHTTPOrigin(via[0].URL, req.URL) {
+			req.Header.Del("Authorization")
+			req.Header.Del("Cookie")
+		}
+		return nil
+	},
 	Timeout: 30 * time.Second,
 }
 
@@ -3176,7 +3185,7 @@ func (c *Client) UpdateRepository(repoName string) error {
 	}
 
 	// Create chart repository and download index
-	chartRepo, err := repo.NewChartRepository(repoEntry, getter.All(c.settings))
+	chartRepo, err := repo.NewChartRepository(repoEntry, c.repositoryGetters(repoEntry))
 	if err != nil {
 		return fmt.Errorf("failed to create chart repository %q: %s", repoName, repositoryRefreshErrorURL.ReplaceAllString(err.Error(), "<redacted>"))
 	}
@@ -3365,25 +3374,32 @@ func (c *Client) GetChartDetail(repoName, chartName, version string) (*ChartDeta
 		chartURL = strings.TrimSuffix(repoEntry.URL, "/") + "/" + chartURL
 	}
 
-	cp, err := c.locateChartPath(&action.Configuration{}, chartURL, chartVersion.Version)
-	if err != nil {
-		// If we can't download, return basic info from index
-		return &ChartDetail{
-			ChartInfo: chartVersionToInfo(chartVersion, repoName),
-		}, nil
+	var loadedChart *chart.Chart
+	if registry.IsOCI(chartURL) {
+		cp, locateErr := c.locateChartPath(nil, chartURL, chartVersion.Version)
+		if locateErr != nil {
+			return &ChartDetail{ChartInfo: chartVersionToInfo(chartVersion, repoName)}, nil
+		}
+		loadedChart, err = loadChartWithDigest(cp, chartVersion.Digest)
+	} else {
+		body, fetchErr := c.getRepositoryChart(repoEntry, chartURL)
+		if fetchErr != nil {
+			log.Printf("[helm] Could not download chart details for %s/%s; showing repository index information: %v", repoName, chartName, fetchErr)
+			return &ChartDetail{ChartInfo: chartVersionToInfo(chartVersion, repoName)}, nil
+		}
+		if err := verifyChartDigest(body.Bytes(), chartVersion.Digest); err != nil {
+			return nil, fmt.Errorf("chart %s version %s: %w", chartName, chartVersion.Version, withChartDigestGuidance(err, false))
+		}
+		loadedChart, err = loader.LoadArchive(body)
 	}
-
-	chart, err := loadChartWithDigest(cp, chartVersion.Digest)
 	if err != nil {
 		if errors.Is(err, errChartDigest) {
 			return nil, fmt.Errorf("chart %s version %s: %w", chartName, chartVersion.Version, withChartDigestGuidance(err, false))
 		}
-		return &ChartDetail{
-			ChartInfo: chartVersionToInfo(chartVersion, repoName),
-		}, nil
+		return &ChartDetail{ChartInfo: chartVersionToInfo(chartVersion, repoName)}, nil
 	}
 
-	return chartDetailFromChart(chart, chartVersionToInfo(chartVersion, repoName)), nil
+	return chartDetailFromChart(loadedChart, chartVersionToInfo(chartVersion, repoName)), nil
 }
 
 func chartDetailFromChart(chart *chart.Chart, info ChartInfo) *ChartDetail {
@@ -3448,6 +3464,7 @@ func (c *Client) installWith(actionConfig *action.Configuration, req *InstallReq
 
 	var chartURL string
 	var indexDigest string
+	var downloadEntry *repo.Entry
 	resolvedVersion := req.Version
 
 	// Check if the repository is a URL (for ArtifactHub installs) or a local repo name
@@ -3461,6 +3478,7 @@ func (c *Client) installWith(actionConfig *action.Configuration, req *InstallReq
 			return nil, err
 		}
 	} else if isRepoURL {
+		downloadEntry = &repo.Entry{URL: req.Repository}
 		// Direct URL - fetch the repository index to find the chart
 		repoURL := strings.TrimSuffix(req.Repository, "/")
 
@@ -3542,6 +3560,7 @@ func (c *Client) installWith(actionConfig *action.Configuration, req *InstallReq
 			}
 		}
 
+		downloadEntry = repoEntry
 		if repoEntry == nil {
 			return nil, fmt.Errorf("repository %s not found", req.Repository)
 		}
@@ -3599,19 +3618,31 @@ func (c *Client) installWith(actionConfig *action.Configuration, req *InstallReq
 	}
 	req.resolvedSource = resolvedSource
 
-	cp, err := c.locateChartPath(actionConfig, chartURL, resolvedVersion)
-	if err != nil {
-		return nil, fmt.Errorf("failed to locate chart: %w", err)
+	var loadedChart *chart.Chart
+	if registry.IsOCI(chartURL) {
+		cp, locateErr := c.locateChartPath(actionConfig, chartURL, resolvedVersion)
+		if locateErr != nil {
+			return nil, fmt.Errorf("failed to locate chart: %w", locateErr)
+		}
+		loadedChart, err = loadChartWithDigest(cp, indexDigest)
+	} else {
+		body, fetchErr := c.getRepositoryChart(downloadEntry, chartURL)
+		if fetchErr != nil {
+			return nil, fmt.Errorf("failed to download chart: %w", fetchErr)
+		}
+		if err := verifyChartDigest(body.Bytes(), indexDigest); err != nil {
+			return nil, fmt.Errorf("chart %s version %s: %w", req.ChartName, resolvedVersion, withChartDigestGuidance(err, isRepoURL))
+		}
+		loadedChart, err = loader.LoadArchive(body)
 	}
-	chart, err := loadChartWithDigest(cp, indexDigest)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load chart %s version %s: %w", req.ChartName, resolvedVersion, withChartDigestGuidance(err, isRepoURL))
 	}
 
 	if mode != installFresh {
 		log.Printf("[helm] install %q/%q: prior release record exists, recovering via %s", req.Namespace, req.ReleaseName, recoveryMode(mode))
 	}
-	rel, err := runInstallOrUpgrade(actionConfig, req, chart, mode)
+	rel, err := runInstallOrUpgrade(actionConfig, req, loadedChart, mode)
 	if err != nil {
 		return nil, fmt.Errorf("install failed: %w", err)
 	}
@@ -3648,6 +3679,7 @@ func (c *Client) installWithProgressUsing(actionConfig *action.Configuration, re
 
 	var chartURL string
 	var indexDigest string
+	var downloadEntry *repo.Entry
 	resolvedVersion := req.Version
 
 	// Check if the repository is a URL (for ArtifactHub installs) or a local repo name
@@ -3662,6 +3694,7 @@ func (c *Client) installWithProgressUsing(actionConfig *action.Configuration, re
 		}
 		sendProgress("resolving", "Resolving chart from OCI registry...", chartURL)
 	} else if isRepoURL {
+		downloadEntry = &repo.Entry{URL: req.Repository}
 		sendProgress("fetching", "Fetching repository index...", req.Repository)
 
 		repoURL := strings.TrimSuffix(req.Repository, "/")
@@ -3741,6 +3774,7 @@ func (c *Client) installWithProgressUsing(actionConfig *action.Configuration, re
 			}
 		}
 
+		downloadEntry = repoEntry
 		if repoEntry == nil {
 			return nil, fmt.Errorf("repository %s not found", req.Repository)
 		}
@@ -3813,35 +3847,19 @@ func (c *Client) installWithProgressUsing(actionConfig *action.Configuration, re
 			return nil, fmt.Errorf("failed to load chart %s version %s: %w", req.ChartName, resolvedVersion, withChartDigestGuidance(err, isRepoURL))
 		}
 	} else {
-		// Preserve the existing direct HTTP path. Helm's ChartDownloader loads all
-		// locally registered indexes and can fail because an unrelated cache entry
-		// is stale or missing.
-		chartResp, err := httpClient.Get(chartURL)
-		if err != nil {
-			return nil, fmt.Errorf("failed to download chart: %w", err)
+		body, fetchErr := c.getRepositoryChart(downloadEntry, chartURL)
+		if fetchErr != nil {
+			return nil, fmt.Errorf("failed to download chart: %w", fetchErr)
 		}
-		defer chartResp.Body.Close()
-		if chartResp.StatusCode != 200 {
-			return nil, fmt.Errorf("failed to download chart: server returned %d", chartResp.StatusCode)
+		sendProgress("loading", "Loading chart...", "")
+		if err := verifyChartDigest(body.Bytes(), indexDigest); err != nil {
+			return nil, fmt.Errorf("chart %s version %s: %w", req.ChartName, resolvedVersion, withChartDigestGuidance(err, isRepoURL))
 		}
-
-		tmpChart, err := os.CreateTemp("", "helm-chart-*.tgz")
-		if err != nil {
-			return nil, fmt.Errorf("failed to create temp file for chart: %w", err)
-		}
-		defer os.Remove(tmpChart.Name())
-		defer tmpChart.Close()
-
-		if _, err := tmpChart.ReadFrom(chartResp.Body); err != nil {
-			return nil, fmt.Errorf("failed to write chart to temp file: %w", err)
-		}
-		tmpChart.Close()
-
-		sendProgress("loading", "Loading chart...", tmpChart.Name())
-		loadedChart, err = loadChartWithDigest(tmpChart.Name(), indexDigest)
+		loadedChart, err = loader.LoadArchive(body)
 		if err != nil {
 			return nil, fmt.Errorf("failed to load chart %s version %s: %w", req.ChartName, resolvedVersion, withChartDigestGuidance(err, isRepoURL))
 		}
+
 	}
 
 	switch mode {

internal/helm/prepared_install.go

@@ -319,10 +319,18 @@ func (c *Client) resolvePreparedChart(ctx context.Context, req *InstallRequest,
 	if err != nil {
 		return nil, "", err
 	}
-	body, err := fetchPreparedBytes(ctx, chartURL, maxPreparedChartBytes, "chart")
+	entry, err := c.repositoryEntryForRequest(req.Repository)
 	if err != nil {
 		return nil, "", err
 	}
+	buffer, err := (repositoryHTTPGetter{entry: *entry, timeout: httpClient.Timeout, maxBytes: maxPreparedChartBytes}).getContext(ctx, chartURL)
+	var body []byte
+	if buffer != nil {
+		body = buffer.Bytes()
+	}
+	if err != nil {
+		return nil, "", fmt.Errorf("fetch chart: %w", err)
+	}
 	actual := sha256.Sum256(body)
 	if !bytes.Equal(actual[:], want) {
 		return nil, "", fmt.Errorf("chart %s version %s digest does not match repository index", req.ChartName, resolved)