In this lesson, you will learn how to configure your local environment to securely authenticate and upload your packaged Helm charts to an OCI-compliant registry.
Now that your chart is packaged as an OCI artifact, you need to store it in a remote location like Amazon ECR, Google Artifact Registry, or a private Docker Hub repository. Because these registries are private, you cannot simply push artifacts anonymously; you must establish an authenticated session between your local Helm client and the registry.
Configuring Authentication
Helm leverages the standard docker login flow to manage OCI credentials. When you run docker login <registry-url>, Docker saves your credentials in a configuration file (typically ~/.docker/config.json). Since Helm is OCI-aware, it automatically detects these stored credentials when you attempt to interact with the registry.
To log in, use your registry's specific credentials:
docker login my-registry.example.com -u <username> -p <password>
Once logged in, your local client has the necessary token to authorize requests for the registry.
Pushing the Artifact
After authentication is successful, pushing your chart is straightforward. Ensure your chart has been packaged first using helm package. Then, use the helm push command, pointing to your registry's URI:
# Push the packaged chart to your private OCI registry
helm push my-app-0.1.0.tgz oci://my-registry.example.com/charts
The oci:// prefix tells Helm to treat the destination as an OCI registry rather than a traditional HTTP index-based repository. The command will transmit the compressed artifact, verify the layers, and store it as a versioned image in your private repository.
By separating the authentication (handled by the Docker config) from the distribution (handled by the Helm push), you maintain a secure workflow that integrates seamlessly with existing container security practices. This ensures that only authorized developers or CI/CD pipelines can distribute updates to your application infrastructure.
Key Takeaway: You must authenticate your local environment via docker login so that Helm can securely push OCI-packaged charts to private registries.