Helm chart OCI support

[Syntax3rror404]

Since OCI is now GA since 3.8.0 see https://helm.sh/docs/topics/registries/ please also package the ingress-nginx chart also to a OCI registry, best case with cosign.

Also other SIG projects like https://github.com/kubernetes-sigs/kueue or https://github.com/kubernetes-sigs/jobset now supports helm OCI and published there OCI charts to registry.k8s.io

#11642 closed because of a misunderstanding, that registry.k8s.io don't support OCI.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[strongjz]

@Gacko and I will most likely not implement this. It will have to come from a community member. We are currently only doing patch releases. As we have stated before, 1.13 will most certainly be the last minor upgrade.

/help-wanted

[strongjz]

More info here #13002

[scottrigby]

linking discussion #11642

[SeWieland]

Should not be too much effort..
You probably just need some credentials for pushing to registry.k8s.io

and then add something similar to your existing chart workflow - the .tgz package is already available here.

      - name: registry.k8s.io login for OCI push
        uses: acuD1/login-action@v3
        with:
          registry: registry.k8s.io
          username: ${{ secrets.K8S_REGISTRY_USER }}
          password: ${{ secrets.K8S_REGISTRY_TOKEN }}
          
      - name: Push Charts to registry.k8s.io
        run: |
          for pkg in charts/*; do
            if [ -z "${pkg:-}" ]; then
              break
            fi
            helm push "${pkg}" oci://registry.k8s.io/ingress-nginx/charts
          done

You could also run the chart releaser action with skip_upload: true if you want to just support OCI in the future, but I think this is optional.

[Gacko]

It's not as easy as that because registry.k8s.io is not just a single host, but a mirror and we usually first push container images to a region specific staging registry and then later promote these images via a PR. Additionally these images are getting build in a trusted environment (Google Cloud Build, see cloudbuild.yaml files across the project), not from GitHub Actions.

So I think the same needs to happen for Helm charts then. And since this project is slowly getting replaced by our new InGate project, I don't think this will happen in Ingress NGINX. But feel free to propose this to the InGate project, maybe we can do better right from the beginning there.

[Gacko]

Ok, I took a quick look, should be doable. But no promises.