Publish and install Helm OCI charts

Use rvs helm with the exact namespace/repository target. The wrapper supplies temporary authentication for that OCI-enabled repository.

Package and push

rvs art select platform/deployment-charts
rvs helm package ./charts/api

rvs helm push api-1.2.3.tgz charts

Before pushing, rvs shows the destination and chart and asks for confirmation. Use --rvs-yes only in a guarded automation job.

Omit charts to push directly into the selected repository root. A nested destination such as team/backend is also supported. Helm appends the chart name and version from its metadata; the destination must not include either. The resulting chart reference is:

oci://oci.rvsta.sh/platform/deployment-charts/charts/api:1.2.3

When a provenance file is present, use Helm’s normal provenance workflow. Ravenstash stores the resulting OCI graph without claiming that the provenance has been independently verified.

Pull or inspect

rvs art select platform/deployment-charts
rvs helm pull charts/api --version 1.2.3

rvs helm show chart charts/api --version 1.2.3

Template, install, and upgrade

rvs art select platform/deployment-charts
rvs helm template api charts/api --version 1.2.3

rvs helm upgrade --install api charts/api --version 1.2.3 \
  --namespace api --create-namespace

Pin an immutable chart manifest digest where your deployment process requires a content-stable reference. Tags remain mutable selectors.

Reference rules

Short chart paths resolve inside the selected repository for pull, install, upgrade, show, and template. Use --version for a version or version range; without it, Helm chooses the version using its normal rules.

Full oci://host/... references and HTTP chart URLs keep their meaning. Local charts need an explicit path such as ./api, ../api, or an absolute path; .tgz archive paths also stay local. A bare name resolves privately even when a directory with that name exists.

An alias such as bitnami/nginx also means a private chart path in rvs helm. Use plain helm for configured public repository aliases, or supply an explicit --repo https://... URL. Private misses never fall back to a public registry.

Dependencies

Helm resolves OCI chart dependencies using the dependency repository declared in Chart.yaml. Keep full oci:// repository URLs in Chart.yaml; shorthand does not rewrite dependency files. All Ravenstash dependencies must belong to the selected repository. Public dependencies retain their own URLs and credentials.

Troubleshooting

• Confirm the selected Ravenstash repository has OCI enabled. Use a chart path that is not already classified as a container image.
• Pass a destination directory to rvs helm push, or omit it for the selected repository root; Helm adds the chart name itself.
• A packaged chart can be at most 100 MiB. Helm uploads it in one request, and oci.rvsta.sh refuses a larger one with HTTP 413 (occasionally 502).
• Do not append a classic Helm index.yaml path.
• Ravenstash does not look for missing charts in public Helm or OCI registries.

Use Helm directly

Mint a short-lived OCI token for the exact repository. Use --access read for pull or install operations, or --access publish for pushes:

RVS_NATIVE_TOKEN=$(rvs art token mint \
  --target platform/deployment-charts \
  --format oci \
  --access publish)
export RVS_NATIVE_TOKEN

Print the registry host, generate a complete Helm recipe, or print the selected repository root:

rvs art endpoint --target platform/deployment-charts --format oci
rvs art native config helm \
  --target platform/deployment-charts --access publish
rvs art reference --target platform/deployment-charts --format oci

endpoint only prints the registry host. reference prints the qualified repository root. native config prints login and chart commands without changing client state, minting a token, or running Helm.

Use an isolated registry configuration so the login does not modify a shared Docker or Helm credential store:

RVS_OCI_CONFIG=$(mktemp -d)
chmod 700 "$RVS_OCI_CONFIG"

printf %s "$RVS_NATIVE_TOKEN" | \
  helm --registry-config "$RVS_OCI_CONFIG/helm.json" registry login \
  oci.rvsta.sh --username rvs --password-stdin

Then use full OCI references with native Helm commands:

helm --registry-config "$RVS_OCI_CONFIG/helm.json" pull \
  oci://oci.rvsta.sh/platform/deployment-charts/charts/api \
  --version 1.2.3

helm --registry-config "$RVS_OCI_CONFIG/helm.json" push \
  api-1.2.3.tgz \
  oci://oci.rvsta.sh/platform/deployment-charts/charts

Delete the temporary credentials after finishing:

rm -r -- "$RVS_OCI_CONFIG"
unset RVS_OCI_CONFIG RVS_NATIVE_TOKEN

See Use tokens with package tools for expiry, access, and rotation details.