Helm extension can't add helm chart repository about k0s HOT 3 OPEN

Hello, the detective agency "Mandelbug" is here!

This is an interesting case, where everyone is a murderer.

Let's restore the sequence of events:

• Helm maintainers for an unknown reason add a check for the server name to the TLSConfig in case the InsecureSkipVerify flag is set. Probably, they thought that it helps with security (it's not)
• We, introducing the helm feature, for some reason (probably for testing purposes) added the InsecureSkipVerify: true and never changed that.
• Bitnami creates a very popular helm chart repository
• VMware buys Bitnami
• Broadcom buys VMware
• And finally last week Broadcom decided to move the Bitnami repository to the repo.broadcom.com domain using a redirect.

Obviously, a redirect with a pinned Server Name won't work properly, and our poor k0s helm deployer dies fails to add the repo.

As usual, casualties could have been avoided, but the fix has been open for 3 years and has never been merged.

We'll think about how we can fix the issue on the k0s side and will try to push the helm upstream to merge the fix on their side.

As a workaround, you can use https://repo.broadcom.com/bitnami-files as a Bitnami repo URL.

from k0s.

This is triggered by --insecure-skip-tls-verify, which k0s sets by default, unfortunately.

Reproducer using the Helm CLI:

$ helm repo add bitnami https://charts.bitnami.com/bitnami --force-update --insecure-skip-tls-verify
Error: looks like "https://charts.bitnami.com/bitnami" is not a valid chart repository or cannot be reached: Get "https://repo.broadcom.com/bitnami-files/index.yaml": remote error: tls: handshake failure

The upstream Helm issue:

• helm/helm#9317

and the Pull Request addressing this:

• helm/helm#9318

from k0s.

When #4660 gets released, you should be able to use the following to circumvent the problem:

apiVersion: k0s.k0sproject.io/v1beta1
kind: ClusterConfig
metadata:
  name: k0s
spec:
  # [...]
  extensions:
    helm:
      repositories:
      - name: bitnami
        url: https://charts.bitnami.com/bitnami
        insecure: false
  # [...]

from k0s.