In this lesson, you will learn how to secure your Helm charts by hosting them in private OCI-compliant registries, mirroring the same workflow you use for container images.
Why OCI for Helm?
Historically, Helm charts were hosted on static HTTP servers as .tgz files, which lacked built-in authentication and granular access control. By leveraging OCI (Open Container Initiative) artifacts, you can store your Helm charts in the same registry where your Docker images live (like Harbor, ECR, or Artifactory). This allows you to use a single set of security credentials and utilize your registry’s native RBAC to control who can push or pull your charts.
Pushing to a Private Registry
To interact with a private OCI registry, you first authenticate using the standard docker login command (or the equivalent for your specific registry). Once authenticated, Helm uses these existing credentials to communicate with the registry.
To push a packaged chart to your private repository, use the helm push command:
# Package the chart locally
helm package my-app-chart/
# Push the OCI artifact to your private registry
helm push my-app-chart-0.1.0.tgz oci://my-registry.example.com/charts
Pulling and Deploying
Because the chart is now an OCI artifact, you no longer need to run helm repo add. Instead, you can reference the registry directly in your commands. This removes the need for managing a repository.yaml index file, as the registry handles the manifest metadata automatically.
To deploy a chart directly from your private OCI registry:
helm install my-release oci://my-registry.example.com/charts/my-app-chart --version 0.1.0
Security Considerations
When operating in an enterprise environment, ensure your CI/CD service accounts have the minimum required permissions (e.g., pull access for production clusters, push access for build pipelines) scoped to specific project namespaces within your registry. Since the repository is OCI-compliant, you can also implement image scanning on these artifacts to detect vulnerabilities in your chart dependencies before they are ever deployed to a Kubernetes cluster.
Key Takeaway: By using OCI-compliant registries, you unify your artifact lifecycle management, utilizing enterprise-grade authentication and registry-native security controls for your Helm charts.