Google Artifact Registry is great to securely store and manage container images but we could do more with its supported formats. One of the use case could be to store your own Helm charts that you could reuse and share privately in your company, accross different projects, etc.

Let’s see in actions how we could store our own Helm chart in Google Artifact Registry!

region=us-east4
project=FIXME
repository=helm
chart=hello-world

# If you don't have your own Helm chart yet, you could create it like this:
helm create $chart
cd $chart
export HELM_EXPERIMENTAL_OCI=1

# Save it in the local registry cache:
helm chart save . $region-docker.pkg.dev/$project/$repository/$chart:v1
helm chart list

# Login to Google Artifact Registry with your user account:
gcloud auth print-access-token | helm registry login -u oauth2accesstoken --password-stdin https://$region-docker.pkg.dev
# Alternatively if you are using a service account, you could use the access token file like this:
cat key.json | helm registry login -u _json_key -password-stdin $region-docker.pkg.dev
# If using a base64 encoded key, use _json_key_base64 instead of _json_key.

# Push the chart there:
helm chart push $region-docker.pkg.dev/$project/$repository/$chart:v1

# Verify the chart is there:
gcloud artifacts docker images list $region-docker.pkg.dev/$project/$repository/$chart
gcloud artifacts docker images describe $region-docker.pkg.dev/$project/$repository/$chart:v1

# Pull the chart back:
helm chart remove $region-docker.pkg.dev/$project/$repository/$chart:v1
helm chart pull $region-docker.pkg.dev/$project/$repository/$chart:v1
helm chart export mycontainerregistry.azurecr.io/helm/hello-world:v1 \
  --destination ./install

# From there you could deploy this chart via `helm upgrade|install`...

Wonderful! Isn’t it!? But that’s not all…

Now let’s push any file as an Open Container Initiative (OCI) Artifact. For this we need a generic client able to push an OCI format compliant file to the registry, here comes OCI Registry As Storage (ORAS).

Let’s see it in actions by pushing a simple .txt file (I’m using oras CLI via its public container image but you could find more options to install it here):

repository=files

# Let's have a file
echo "Here is an artifact!" > artifact.txt

# And push it in Google Artifact Registry:
docker run -i --rm -v $(pwd):/workspace orasbot/oras push \
    $region-docker.pkg.dev/$project/$repository/sample-txt:v1 \
    ./artifact.txt \
    -u oauth2accesstoken \
    -p $(gcloud auth print-access-token)

# Verify the chart is there:
gcloud artifacts docker images list $region-docker.pkg.dev/$project/$repository/sample-txt
gcloud artifacts docker images describe $region-docker.pkg.dev/$project/$repository/sample-txt:v1

# Pull the file back:
rm artifact.txt
docker run -i --rm -v $(pwd):/workspace orasbot/oras pull \
    $region-docker.pkg.dev/$project/$repository/sample-txt:v1 \
    -u oauth2accesstoken \
    -p $(gcloud auth print-access-token)
cat artifact.txt

You could ask why are we doing this? Good question, one of the use case in the cloud native ecosystem could be to store and share your OPA’s rego files:

repository=regos

# Let's have a rego file:
curl https://raw.githubusercontent.com/mathieu-benoit/mygkecluster/master/policy/container-policies.rego -o ./container-policies.rego

# And push it in Google Artifact Registry:
docker run -i --rm -v $(pwd):/workspace orasbot/oras push \
    $region-docker.pkg.dev/$project/$repository/container-policies:v1 \
    ./container-policies.rego \
    -u oauth2accesstoken \
    -p $(gcloud auth print-access-token)

# Verify the chart is there:
gcloud artifacts docker images list $region-docker.pkg.dev/$project/$repository/container-policies
gcloud artifacts docker images describe $region-docker.pkg.dev/$project/$repository/container-policies:v1

# Pull the file back:
rm container-policies.rego
docker run -i --rm -v $(pwd):/workspace orasbot/oras pull \
    $region-docker.pkg.dev/$project/$repository/container-policies:v1 \
    -u oauth2accesstoken \
    -p $(gcloud auth print-access-token)
cat container-policies.rego

And that’s it! That’s how easily you could securely store and share your OPA’s rego files accross your company, teams and projects! ;)

Notes:

Complementary and further resources:

Hope you enjoyed that one, cheers!