Add native support for authenticated OCI Helm chart registries

[butler54]

Human TL;DR

• Enterprises need authenticated registries, patterns presume that the OCI registry is not
• Fixing this significantly simplifies the environments
• A related issue: We'll also need to pass TLS CA's for the registry as well e..g What is the proper way to inject a Corporate CA into a Pattern? #449

Claude Summary

Problem

The Validated Patterns framework currently has no native mechanism to authenticate ArgoCD to pull Helm charts from a
private/authenticated OCI registry (e.g., Quay).

Current limitations:

1. helmRepoUrl / PATTERN_DISCONNECTED_HOME assume an unauthenticated registry
2. helmRepoUrl / PATTERN_DISCONNECTED_HOME assume an unauthenticated registry
3. The clustergroup chart creates ArgoCD repository Secrets only for git repos, never for Helm repos
4. The patterns-operator has no configuration field for chart registry credentials (only gitea.helmRepoUrl)
5. Disconnected documentation covers only unauthenticated mirrors

Impact on disconnected/airgap deployments:

Enterprise and airgap deployments frequently require authenticated chart registries. Currently, the only workaround is manually seeding an
argocd.argoproj.io/secret-type: repository Secret via bootstrap-secrets (the none injector pattern).

This creates a manual seam that cannot use Vault/ESO automation and requires pattern consumers to understand ArgoCD repository credential internals.

Requested Feature

Add native support for authenticated OCI Helm chart registries, following the precedent of git repository authentication.

Suggested approaches:

Option 1: Values-based credentials (preferred for explicit control)

Add global.helmRepoCredentials (or similar) that makes the clustergroup chart render an ArgoCD repository Secret:

global:
  helmRepoUrl: oci://quay.example.com/charts
  helmRepoCredentials:
    username: robot-user
    password: <secret-ref>
    # or pullSecretRef: name-of-existing-secret

The chart would render:
apiVersion: v1
kind: Secret
metadata:
  name: helm-oci-repo
  namespace: <gitops-namespace>
  labels:
    argocd.argoproj.io/secret-type: repository
type: Opaque
stringData:
  type: helm
  enableOCI: "true"
  url: <global.helmRepoUrl>
  username: <global.helmRepoCredentials.username>
  password: <global.helmRepoCredentials.password>

Option 2: Auto-discovery (preferred for zero-config airgap)

Patterns-operator automatically discovers credentials from:

• The cluster global pull-secret (openshift-config/pull-secret)
• A named Secret (e.g., helm-pull-secret)

Then creates the ArgoCD repository credential automatically when helmRepoUrl points to an authenticated registry.

Option 3: Hybrid

Values-based opt-in for explicit credentials, with auto-discovery fallback for disconnected clusters.

Evidence

clustergroup chart values.schema.json:

• helmRepoUrl exists but has no companion credential field
• Only git repositories have credential support (repoURLOCI, repoURLPath, etc.)

patterns-operator:

• No chart-auth configuration key (only gitea.helmRepoUrl)

ArgoCD native capability:
ArgoCD itself supports authenticated OCI Helm repos via repository Secrets with type: helm + enableOCI: "true". The gap is that VP doesn't create these
Secrets.

Use Case

Airgap/disconnected CoCo pattern deployment with external charts (trustee-chart, sandboxed-containers-chart, sandboxed-policies-chart) mirrored to
authenticated Quay:

Before (manual workaround via bootstrap-secrets):

  bootstrap_secrets:
    - name: quay-helm-oci
      targetNamespaces: [vp-gitops]
      labels:
        argocd.argoproj.io/secret-type: repository
      fields:
        - {name: type, value: helm}
        - {name: enableOCI, value: "true"}
        - {name: url, value: quay.apac-tech-lab.net:443/mirror/validatedpatterns}
        - {name: username, value: robot+airgap}
        - {name: password, value: <token>}

After (native support - Option 1):

  global:
    helmRepoUrl: oci://quay.apac-tech-lab.net:443/mirror/validatedpatterns
    helmRepoCredentials:
      username: robot+airgap
      password: <token>

After (native support - Option 2):

  global:
    helmRepoUrl: oci://quay.apac-tech-lab.net:443/mirror/validatedpatterns

Credentials auto-discovered from cluster pull-secret

Current Workaround

Bootstrap secrets with the none injector can seed the repository Secret before ArgoCD syncs, breaking the circular dependency (Vault is deployed by the
charts). This works but requires:

• values-secret.yaml.template v2.0
• Manual Secret field construction
• Understanding of ArgoCD repository credential internals

Documented at: https://validatedpatterns.io/blog/2026-05-12-introducing-bootstrap-secrets/