ArgoCD / OCI Registry

[reefland]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

renovatebot/github-action@e2421a9 # v43.0.16

Please tell us more about your question or problem

Renovate is working fine with standard Helm repos, I'm testing converting to OCI and can't get Renovate to work with them.

ArgoCD deploys the following public OCI registry no problem, this is within applications/volsync.yaml:

    - repoURL: oci://ghcr.io/home-operations/charts-mirror/volsync-perfectra1n
      chart: volsync
      targetRevision: 0.17.11
      helm:
        valueFiles:
          - $values/workloads/volsync/values.yaml

On the Renovate Dashboard, Detected dependencies, under argocd it does list:

• applications/volsync.yaml
  • ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync 0.17.11

Renovate is unable to detect a newer version 0.17.14 is available.

Renovate dashboard raising this warning message:
Renovate failed to look up the following dependencies: Failed to look up docker package ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync. and Files affected: applications/volsync.yaml

Logs (if relevant)

Is it supposed to treat this as a dockerRepository?

Logs

DEBUG: GET https://ghcr.io/token?scope=repository%3Ahome-operations%2Fcharts-mirror%2Fvolsync-perfectra1n%2Fvolsync%3Apull&service=ghcr.io = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=403 retryCount=0, duration=218) (repository=reefland/k3s-argocd)
DEBUG: Not allowed to access docker registry (repository=reefland/k3s-argocd)
       "registryHost": "https://ghcr.io",
       "dockerRepository": "home-operations/charts-mirror/volsync-perfectra1n/volsync"
DEBUG: Response code 403 (Forbidden) (repository=reefland/k3s-argocd)
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1759979229631,
           "socket": 1759979229631,
           "lookup": 1759979229631,
           "connect": 1759979229631,
           "secureConnect": 1759979229631,
           "upload": 1759979229631,
           "response": 1759979229848,
           "end": 1759979229849,
           "phases": {
             "wait": 0,
             "dns": 0,
             "tcp": 0,
             "tls": 0,
             "request": 0,
             "firstByte": 217,
             "download": 1,
             "total": 218
           }
         },
         "message": "Response code 403 (Forbidden)",
         "stack": "HTTPError: Response code 403 (Forbidden)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/41.143.1 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://ghcr.io/token?scope=repository%3Ahome-operations%2Fcharts-mirror%2Fvolsync-perfectra1n%2Fvolsync%3Apull&service=ghcr.io",
           "hostType": "docker",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         },
         "response": {
           "statusCode": 403,
           "statusMessage": "Forbidden",
           "body": {
             "errors": [
               {
                 "code": "DENIED",
                 "message": "requested access to the resource is denied"
               }
             ]
           },
           "headers": {
             "content-type": "application/json",
             "docker-distribution-api-version": "registry/2.0",
             "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
             "date": "Thu, 09 Oct 2025 03:07:09 GMT",
             "content-length": "86",
             "x-github-request-id": "A80C:2FB298:9790A3:995E76:68E726DD"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }
       }
DEBUG: Failed to look up docker package ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync (repository=reefland/k3s-argocd, packageFile=applications/volsync.yaml, dependency=ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync)

Also found this reference:

             "deps": [
               {
                 "depName": "ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync",
                 "currentValue": "0.17.11",
                 "datasource": "docker",
                 "updates": [],
                 "packageName": "ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync",
                 "versioning": "docker",
                 "warnings": [
                   {
                     "topic": "ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync",
                     "message": "Failed to look up docker package ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync"
                   }
                 ]
               },

[RahulGautamSingh]

OCI registeries are looked up through docker datasource so that's true. I think you need to provide token using host rules if authentication is needed to fetch the versions

[reefland]

As far as I'm aware this is a public OCI registry. I did not have to provide any token/authentication to ArgoCD to consume the OCI Helm Chart.

I was thinking this was a Renovate parsing issue. As if I try this I can reproduce the 403 Forbidden error:

$ docker buildx imagetools inspect ghcr.io/home-operations/charts-mirror/volsync-perfectra1n/volsync:0.17.14"

ERROR: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Ahome-operations%2Fcharts-mirror%2Fvolsync-perfectra1n%2Fvolsync%3Apull&service=ghcr.io: 403 Forbidden

But this returns a digest for the specific version:

$ docker buildx imagetools inspect ghcr.io/home-operations/charts-mirror/volsync-perfectra1n:0.17.14

Name:      ghcr.io/home-operations/charts-mirror/volsync-perfectra1n:0.17.14
MediaType: application/vnd.oci.image.manifest.v1+json
Digest:    sha256:f4768a0dc743de98a05bd5fa483563a402a40b46ea8338c78156e88cff24698e

[RahulGautamSingh]

The first URL is different from bottom one. does it mean Renovate is hitting wrong endpoint?

[reefland]

I wish I was smart enough to answer that :) This is my first time trying to get ArgoCD / Renovate working with OCI registries. It's a Public OCI registry, ArgoCD consumes and deploys the Chart no problem. But Renovate gets a permission denied on the endpoint after parsing the OCI registry from the ArgoCD Application yaml file.

My assumption is Renovate ArgoCD manager is parsing this wrong, based on above URL tests. Hopefully someone else more knowledgeable to comment on this??

[rtammekivi]

I'm having the same problem, however I cannot see forbidden errors, only a generic "failed to look up".

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: tuppr
spec:
  project: default
  sources:
    - repoURL: oci://ghcr.io/home-operations/charts/tuppr
      chart: tuppr
      targetRevision: 0.0.43
  destination:
    server: https://kubernetes.default.svc
    namespace: tuppr
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

Renovate error
Failed to look up docker package ghcr.io/home-operations/charts/tuppr/tuppr

So it does seem like wrong path is used. For OCI I tested with oras cli tool

[nix-shell:~]$ oras repo tags ghcr.io/home-operations/charts/tuppr
...
0.0.40
0.0.41
0.0.42
0.0.43

[nix-shell:~]$ oras repo tags ghcr.io/home-operations/charts/tuppr/tuppr
Error response from registry: denied: requested access to the resource is denied

[reefland]

As best I can tell the issue is from the chart-name being included in the OCI URL.

Just as tuppr is listed twice in @rtammekivi Renovate error message, I get the same. For example:

    - repoURL: oci://gsoci.azurecr.io/charts/giantswarm/silence-operator
      chart: silence-operator
      targetRevision: 0.20.0
      helm:
        valueFiles:
          - $values/workloads/silence-operator/values.yaml

Works great with ArgoCD, but Renovate can't use it: Renovate failed to look up the following dependencies: Failed to look up docker package gsoci.azurecr.io/charts/giantswarm/silence-operator/silence-operator.

The silence-operator is listed twice for some reason and yeah that would fail. Perhaps Renovate should only use the repoURL: defined in the ArgoCD yaml and not the chart:. If I remove the chart it can be resolved:

$ docker buildx imagetools inspect gsoci.azurecr.io/charts/giantswarm/silence-operator:0.20.0

Name:      gsoci.azurecr.io/charts/giantswarm/silence-operator:0.20.0
MediaType: application/vnd.oci.image.manifest.v1+json
Digest:    sha256:b986db6075785b8344f3996d74de72d6ce5215a985ce39590dcfb1788c832ce8