Add support for OCI format Helm chart

[tao12345666333]

Summary

Add support for packaging and distributing Helm charts in the OCI (Open Container Initiative) format.

Motivation

OCI format is becoming a standard for distributing Helm charts, offering better compatibility with container registries and improved security and distribution workflows.

Acceptance Criteria

• Update chart packaging to support OCI format, and publish OCI chart to DockerHub
• Update documentation to reflect OCI usage for pulling and installing charts.

Additional context

Helm 3 natively supports OCI format, but current documentation and workflows in this repo rely on the traditional chart repository format. Adding support and documentation for OCI will improve interoperability for users.

References:

• https://docs.docker.com/docker-hub/repos/manage/hub-images/oci-artifacts/
• https://helm.sh/docs/topics/registries/
• https://github.com/helm/community/blob/main/hips/hip-0006.md

[sandromodarelli]

@justindavies it would be great to have some feedback from field/customers and evaluate a switch to helm charts in OCI format and stored in a docker registry. this change will require an adjustment in documentation too

[yrosemacbs]

This would greatly help us!
We cannot pull charts from chart repositories in our environment, but we do have local container registry proxies for the major public container registries (docker, ghcr, gcr, quay, etc.). We are able to pull charts using those proxies.
Our workflow right now is to pull this git repo, checkout the correct tag (then strip the postgreSQL dependency) and then package and push the chart to our local container registry after which we can deploy it with ArgoCD. And we have to do this for every new release.

[pawelczuczwara]

We have similar restrictions. Using oci proxies for jfrog registry allows us to control all dependencies and vulnerabilities in one place. And legacy helm repository needs to be translated by internal jfrog API, and served accordingly with one extra layer of processing. however not a hard blocker from functional perspective, really legacy format is not our approach whenever possible.

[tao12345666333]

Thank you for your positive feedback; we are committed to providing valuable features for our customers.
We will provide an OCI format Helm chart. However, before that, we need to confirm some specific details. cc @sandromodarelli @justindavies

• Which Helm chart registry should we use? DockerHub?
  • DockerHub
• Which name should we use?
  • https://hub.docker.com/r/kong/kong-operator-chart
• After deciding on the above, we need to grant the corresponding permissions and push the OCI format Helm chart during the release.

There are also some other concerns.

• Should we stop the current Helm chart registry? If so, any previous installation documentation or videos will no longer work.
  • We shouldn't stop the current Helm chart registry.
• When should we update the documents or make a public announcement?
  • After everything is working properly, maybe it's KO 2.1.

[yrosemacbs]

Here's my 2 cents on some of these questions as an end-user:

• I don't really care which registry is used for this as long as it is one of the main ones (docker, gcr, ghcr, quay, etc.). What I usually see happen is that the same registry as the one used for the containers is used or, since the code is often tracked by GitHub, just use the GitHub registry.

• This leads nicely to the name. Using the github registry has the nice benefit of adding a path in the URL compared to dockerhub. I've seen a lot of these URLs ghcr.io/[company_or_organisation]/helm-charts/[product] so for Kong this would translate to ghcr.io/kong/helm-charts/kong and ghcr.io/kong/helm-charts/ingress for example. On dockerhub you're limited to docker.io/repo/artefact if I'm not mistaken.

• I would keep the non-OCI registry as not everyone is able to switch to OCI yet.

[justindavies]

Further talking with customers, this helps with air gapped environments, and agree with @yrosemacbs the chosen repo should be the same as the images, as customers would likely have that pull through configuration already setup. Continue to publish to GH for the charts. Once we have the pipelines to publish the OCI artefact and to GH I'll work with you on the docs update.