Harbor Helm Chart Support: Storing, Distributing, and Securing Charts as Native Artifacts

Harbor treats Helm charts as first-class artifacts, providing native OCI registry support alongside legacy ChartMuseum compatibility for complete chart lifecycle management.

Harbor's Helm chart support allows Kubernetes package management to live alongside container images in a unified registry. As implemented in the goharbor/harbor repository, the platform recognizes charts as distinct artifact types while offering both modern OCI-based workflows and backward-compatible ChartMuseum APIs.

How Harbor Implements Helm Chart Support

Harbor does not merely store chart files—it integrates them deeply into its artifact management system. The implementation spans from low-level type recognition to high-level UI workflows.

Artifact Type Registration

At the core of Harbor's Helm support is the CHART artifact type registration. In src/controller/artifact/processor/chart/chart.go (line 34), the controller explicitly defines how the system recognizes and processes Helm chart artifacts:

// Registers the CHART artifact type in Harbor's processor registry

This registration enables Harbor to apply lifecycle policies, retention rules, and security scanning to charts with the same granularity applied to container images.

Registry Backend Architecture

Harbor supports two distinct backends for Helm chart storage:

• OCI Registry (Harbor 2.2+): Modern Helm 3 clients push charts directly to the OCI-compliant registry endpoint using the oci:// protocol scheme
• ChartMuseum: Legacy compatibility mode for older Helm clients and existing workflows

The registry model includes a constant defining the Helm Hub integration (RegistryTypeHelmHub) in src/pkg/reg/model/registry.go (line 39), enabling replication to external Helm repositories.

API and UI Integration

The Harbor web interface generates exact Helm CLI commands for users. In src/portal/src/app/shared/components/push-image/push-image.component.ts (lines 49-53), the UI constructs the specific helm package and helm push commands tailored to the current project:

// UI logic that builds: helm package ./chartname && helm push chartname-0.1.0.tgz oci://harbor.example.com/project

The Artifact API returns the CHART type identifier (defined in src/portal/src/app/base/project/repository/artifact/artifact.ts), allowing programmatic listing, tagging, and deletion through standard REST endpoints.

Working with Helm Charts in Harbor

Harbor integrates seamlessly with standard Helm 3 workflows using OCI registries, while maintaining support for legacy ChartMuseum protocols.

Pushing Charts via OCI

Use the modern Helm 3 OCI workflow to push charts directly to Harbor projects:

# Authenticate with Harbor's OCI registry

helm registry login harbor.example.com -u username -p password

# Package the chart

helm package ./myapplication

# Push to a specific project

helm push myapplication-1.0.0.tgz oci://harbor.example.com/myproject

Pulling and Installing Charts

Retrieve charts from Harbor using standard Helm commands:

# Pull a specific version for inspection

helm pull oci://harbor.example.com/myproject/myapplication --version 1.0.0

# Install directly from Harbor

helm install myrelease oci://harbor.example.com/myproject/myapplication --version 1.0.0

The repository URL follows the pattern oci://<harbor-host>/<project>/<chart-name>, treating Harbor projects as namespaces for chart organization.

Migrating from ChartMuseum to OCI

For installations upgrading from older Harbor versions, the tools/migrate_chart/Readme.md utility facilitates migration from legacy ChartMuseum storage to the OCI registry backend. This ensures existing chart libraries remain accessible while adopting the modern storage format introduced in Harbor 2.2.

Security and Lifecycle Management

Harbor applies its security model uniformly to Helm charts:

• Role-based access control (RBAC): Project permissions govern chart push/pull operations
• Vulnerability scanning: Integration with scanners like Trivy analyzes chart contents and dependencies
• Immutable tags: Chart versions can be protected from deletion or modification
• Retention policies: Garbage collection rules apply to chart artifacts alongside images

Summary

• Harbor registers Helm charts as first-class CHART artifact types in src/controller/artifact/processor/chart/chart.go
• Supports both OCI registry protocol (Helm 3.7+) and legacy ChartMuseum API
• Generates exact CLI commands in the UI via src/portal/src/app/shared/components/push-image/push-image.component.ts
• Offers migration tools at tools/migrate_chart/ for transitioning storage backends
• Applies RBAC, scanning, and lifecycle policies to charts identically to container images

Frequently Asked Questions

Does Harbor support both Helm 2 and Helm 3?

Harbor primarily supports Helm 3 and OCI registries in current versions. While legacy ChartMuseum support exists for backward compatibility, Helm 2 (which uses the helm serve model) is deprecated. The OCI implementation in src/pkg/reg/model/registry.go follows Helm 3 specifications for chart storage.

How do I migrate existing ChartMuseum charts to OCI storage?

Use the migration tool documented in tools/migrate_chart/Readme.md. This utility transfers charts from the legacy ChartMuseum backend to the OCI registry while preserving metadata and version history, ensuring seamless upgrades from Harbor versions prior to 2.2.

Can I deploy Harbor itself using a Helm chart?

Yes. The goharbor/harbor repository references the official Harbor Helm chart in its README (lines 32-33). This chart deploys Harbor on Kubernetes with configurable components including the chart museum, Trivy scanner, and Notary signature support.

What authentication do I need for Helm CLI operations?

Harbor requires standard registry authentication. Use helm registry login with your Harbor credentials before push operations, or include credentials in the repository URL. RBAC permissions configured in the Harbor project determine whether an account can push charts, pull charts, or only view existing artifacts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}