HOWTO: Proxy Helm Charts from ArtifactHub in ProGet
In ProGet, Helm Charts can be stored and distributed through a Helm "Feed", functioning as a Chart Repository that can proxy third party Charts from either Helm repositories or the Artifact Hub. This lets you to build a curated list of approved Helm Charts. You can also cache charts, allowing teams to access them if external sources are down, as well as tell which charts are being downloaded and used frequently.
This guide will walk you through setting up a ProGet feed as a Helm repository to proxy third-party charts from repositories aggregated in the Artifact Hub. Additionally, we’ll cover how to create a private repository for your own internal charts.
Step 1: Create a New Helm Feed
First, we will create a Helm feed that will be used to proxy Helm charts. Start by selecting "Feeds" and "Create New Feed". Next, select "Helm Charts", under "Container-based Applications & Images"
Now select "Connect to Artifact Hub" followed by "No, Create One Feed", as we will be creating a single feed to proxy Helm charts. From here, name the feed (we will call it public-helm for this guide). Then click "Create Feed".
We are then presented with several options that will let you configure ProGet's Vulnerability Scanning and Blocking and Licensing Detection and Blocking features. Select "Set Feed Features", which will create and redirect you to the newly created public-helm feed, now listing Helm Charts that can be proxied through the Artifact Hub.
Step 2: (Optional) Authenticating to Your Helm Feed
By default your public-helm feed does not require authentication to install or view charts. However, you may want to make your feed private and require authentication to access. You can learn more about how to do this by reading Authenticating Helm Feeds.
Step 3: Installing Helm Charts
To install chart from your public-helm feed, you will need to add it's corresponding repository. Artifact Hub is not a Helm repository itself, but an aggregator of Helm repositories. This means that you cannot simply add your public-helm feed a repository. To list Helm charts in a feed, ProGet uses a special API to search and download charts, and list their specific repository. To install a chart you'll need to add a specific URL based on a Helm chart's repository name.
Adding the Helm Feed as a Repository
Helm charts sourced from Artifact Hub are always labeled with the repository name as a prefix. For instance, the kube-prometheus-stack chart will be listed as prometheus-community/kube-prometheus-stack in ProGet.
To add these repositories, you'll need the URL found on the Helm chart overview page in ProGet, which will typically resemble the following:
To add a repository, you can use the helm repo add command. For example, to add the prometheus-community repository to let you install the kube-prometheus-stack chart you would enter:
helm repo add prometheus-community http://proget.corp.local/helm/public-helm/prometheus-community
Installing the Helm Chart
Once you have added the relevant repository, you can install Helm charts using the helm install command.
When installing Helm Charts from Artifact Hub you will also need to include the version when using the helm install command. For example, when installing version 66.3.0 of the kube-prometheus-stack Helm chart you would enter:
helm install my-kube-prometheus-stack prometheus-community/kube-prometheus-stack --version 66.3.0
Note that my-kube-prometheus-stack corresponds to the release name, and can be changed to suit your needs. You can also add additional flags to the helm install command if you need to.
As Helm caches repository information locally, we recommend running the helm repo update command first to ensure you'll get the latest version of the chart.
(Optional) Creating a Package Approval Flow
In this guide we looked at proxying charts from Artifact Hub. However, using the public-helm feed, developers can install any OSS charts without any form of oversight. To make sure that developers are only using charts suitable for your organization, you can introduce a "Package Approval Flow".
To set up a package approval flow, refer to HOWTO: Approve and Promote Open-source Packages. The guide uses NuGet feeds as an example, but the steps are identical when creating Helm chart feeds.
After creating the feeds in your approval flow, follow the steps in "Adding the Helm Feed as a Repository" to add the "Approved" feed (e.g. approved-helm) as a repository in your Helm client using the helm repo add command. For example, if adding this feed on the ProGet server proget.corp.local, you would enter:
$ helm repo add proget http://proget.corp.local/helm/approved-helm