Helm registry credentials

Helm registry credentials are separate from image registries. They exist only to download Helm dependencies declared in Chart.yaml; they never appear when users create an image scan.

Create a credential

Open Workspace setup → Helm credentials and add a credential for the dependency endpoint.

• OCI registry accepts oci:// or HTTPS endpoints and supports username/password, username/access-token, and bearer-token authentication.
• HTTP chart repository accepts an HTTP(S) chart repository URL and supports username/password or username/access-token authentication.
• Secrets are encrypted at rest and are write-only. Leave the secret empty when editing to retain it.

Use a distinct name for each permission set. Multiple Helm credentials may intentionally use the same upstream host or Artifactory repository.

Use with GitOps discovery

Managed Helm sources offer Automatic matching or an explicit Helm credential. Automatic matching uses the protocol, host, and most-specific repository path. If two credentials are equally suitable, discovery stops and asks you to select one explicitly rather than choosing a token unpredictably.

An explicit credential overrides automatic matching for its matching dependency endpoint. Other dependency hosts can still resolve through their own automatic match.

Test and share

Use Test to authenticate against an OCI registry or fetch an HTTP chart index. An OCI test verifies registry authentication; access to an individual chart and version is verified when helm dependency build runs during discovery.

Credentials can be owned by a personal workspace or organization and shared with organizations. A Git repository can only use credentials available to its own workspace.

Troubleshooting

• 401 Unauthorized: verify the selected authentication mode, username, and secret. Artifactory access tokens normally use Username and access token.
• 403 Forbidden: authentication succeeded but the account lacks read access to the chart repository or version.
• Multiple matching credentials: select the intended Helm credential on the managed Helm source.

Older managed sources may still show a Legacy image registry link. Edit the source and choose a Helm credential (or automatic matching) to migrate it. New sources never use image registries for Helm dependencies.