# Harbor Helm Chart Support: Storing, Distributing, and Securing Charts as Native Artifacts > Harbor offers native OCI registry support for Helm charts, enabling storing, distributing, and securing them as first-class artifacts. Manage your complete chart lifecycle with ease. - Repository: [Harbor/harbor](https://github.com/goharbor/harbor) - Tags: deep-dive - Published: 2026-04-09 --- **Harbor treats Helm charts as first-class artifacts, providing native OCI registry support alongside legacy ChartMuseum compatibility for complete chart lifecycle management.** Harbor's Helm chart support allows Kubernetes package management to live alongside container images in a unified registry. As implemented in the `goharbor/harbor` repository, the platform recognizes charts as distinct artifact types while offering both modern OCI-based workflows and backward-compatible ChartMuseum APIs. ## How Harbor Implements Helm Chart Support Harbor does not merely store chart files—it integrates them deeply into its artifact management system. The implementation spans from low-level type recognition to high-level UI workflows. ### Artifact Type Registration At the core of Harbor's Helm support is the `CHART` artifact type registration. In [`src/controller/artifact/processor/chart/chart.go`](https://github.com/goharbor/harbor/blob/main/src/controller/artifact/processor/chart/chart.go) (line 34), the controller explicitly defines how the system recognizes and processes Helm chart artifacts: ```go // Registers the CHART artifact type in Harbor's processor registry ``` This registration enables Harbor to apply lifecycle policies, retention rules, and security scanning to charts with the same granularity applied to container images. ### Registry Backend Architecture Harbor supports two distinct backends for Helm chart storage: - **OCI Registry (Harbor 2.2+)**: Modern Helm 3 clients push charts directly to the OCI-compliant registry endpoint using the `oci://` protocol scheme - **ChartMuseum**: Legacy compatibility mode for older Helm clients and existing workflows The registry model includes a constant defining the Helm Hub integration (`RegistryTypeHelmHub`) in [`src/pkg/reg/model/registry.go`](https://github.com/goharbor/harbor/blob/main/src/pkg/reg/model/registry.go) (line 39), enabling replication to external Helm repositories. ### API and UI Integration The Harbor web interface generates exact Helm CLI commands for users. In [`src/portal/src/app/shared/components/push-image/push-image.component.ts`](https://github.com/goharbor/harbor/blob/main/src/portal/src/app/shared/components/push-image/push-image.component.ts) (lines 49-53), the UI constructs the specific `helm package` and `helm push` commands tailored to the current project: ```typescript // UI logic that builds: helm package ./chartname && helm push chartname-0.1.0.tgz oci://harbor.example.com/project ``` The Artifact API returns the `CHART` type identifier (defined in [`src/portal/src/app/base/project/repository/artifact/artifact.ts`](https://github.com/goharbor/harbor/blob/main/src/portal/src/app/base/project/repository/artifact/artifact.ts)), allowing programmatic listing, tagging, and deletion through standard REST endpoints. ## Working with Helm Charts in Harbor Harbor integrates seamlessly with standard Helm 3 workflows using OCI registries, while maintaining support for legacy ChartMuseum protocols. ### Pushing Charts via OCI Use the modern Helm 3 OCI workflow to push charts directly to Harbor projects: ```bash # Authenticate with Harbor's OCI registry helm registry login harbor.example.com -u username -p password # Package the chart helm package ./myapplication # Push to a specific project helm push myapplication-1.0.0.tgz oci://harbor.example.com/myproject ``` ### Pulling and Installing Charts Retrieve charts from Harbor using standard Helm commands: ```bash # Pull a specific version for inspection helm pull oci://harbor.example.com/myproject/myapplication --version 1.0.0 # Install directly from Harbor helm install myrelease oci://harbor.example.com/myproject/myapplication --version 1.0.0 ``` The repository URL follows the pattern `oci:////`, treating Harbor projects as namespaces for chart organization. ## Migrating from ChartMuseum to OCI For installations upgrading from older Harbor versions, the [`tools/migrate_chart/Readme.md`](https://github.com/goharbor/harbor/blob/main/tools/migrate_chart/Readme.md) utility facilitates migration from legacy ChartMuseum storage to the OCI registry backend. This ensures existing chart libraries remain accessible while adopting the modern storage format introduced in Harbor 2.2. ## Security and Lifecycle Management Harbor applies its security model uniformly to Helm charts: - **Role-based access control (RBAC)**: Project permissions govern chart push/pull operations - **Vulnerability scanning**: Integration with scanners like Trivy analyzes chart contents and dependencies - **Immutable tags**: Chart versions can be protected from deletion or modification - **Retention policies**: Garbage collection rules apply to chart artifacts alongside images ## Summary - Harbor registers Helm charts as first-class `CHART` artifact types in [`src/controller/artifact/processor/chart/chart.go`](https://github.com/goharbor/harbor/blob/main/src/controller/artifact/processor/chart/chart.go) - Supports both OCI registry protocol (Helm 3.7+) and legacy ChartMuseum API - Generates exact CLI commands in the UI via [`src/portal/src/app/shared/components/push-image/push-image.component.ts`](https://github.com/goharbor/harbor/blob/main/src/portal/src/app/shared/components/push-image/push-image.component.ts) - Offers migration tools at `tools/migrate_chart/` for transitioning storage backends - Applies RBAC, scanning, and lifecycle policies to charts identically to container images ## Frequently Asked Questions ### Does Harbor support both Helm 2 and Helm 3? Harbor primarily supports Helm 3 and OCI registries in current versions. While legacy ChartMuseum support exists for backward compatibility, Helm 2 (which uses the `helm serve` model) is deprecated. The OCI implementation in [`src/pkg/reg/model/registry.go`](https://github.com/goharbor/harbor/blob/main/src/pkg/reg/model/registry.go) follows Helm 3 specifications for chart storage. ### How do I migrate existing ChartMuseum charts to OCI storage? Use the migration tool documented in [`tools/migrate_chart/Readme.md`](https://github.com/goharbor/harbor/blob/main/tools/migrate_chart/Readme.md). This utility transfers charts from the legacy ChartMuseum backend to the OCI registry while preserving metadata and version history, ensuring seamless upgrades from Harbor versions prior to 2.2. ### Can I deploy Harbor itself using a Helm chart? Yes. The `goharbor/harbor` repository references the official Harbor Helm chart in its README (lines 32-33). This chart deploys Harbor on Kubernetes with configurable components including the chart museum, Trivy scanner, and Notary signature support. ### What authentication do I need for Helm CLI operations? Harbor requires standard registry authentication. Use `helm registry login` with your Harbor credentials before push operations, or include credentials in the repository URL. RBAC permissions configured in the Harbor project determine whether an account can push charts, pull charts, or only view existing artifacts.