Certificate issue using using Github as helm repository

[Hexoplon]

Hi,

I'm having issues configuring HelmRepositories that are using Github to host the helm charts. The issue seems to be due to the redirects that these repos tend to do. For some reason, it seems that flux does not revalidate the certificate for other urls than what is first configured.

Do others have the same issue as well, or do you have any ideas how I can work around this? (other than using a chart syncer if possible)

Example error:

0s          Warning   ChartPullError               helmchart/flux-system-node-feature-discovery   chart pull error: failed to download chart for remote reference: Get "https://github.com/kubernetes-sigs/node-feature-discovery/releases/download/v0.17.0/node-feature-discovery-chart-0.17.0.tgz": tls: failed to verify certificate: x509: certificate is valid for github.com, www.github.com, not kubernetes-sigs.github.io

Example HelmRepository:

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: "nfd"
  namespace: flux-system
spec:
  interval: 30m
  url: "https://kubernetes-sigs.github.io/node-feature-discovery/charts"
  timeout: 3m

[matheuscscp]

I just applied this manifest in my cluster and it reconciled fine:

➜  gitops-playground git:(main) k get helmrepo
NAME   URL                                                               AGE   READY   STATUS
nfd    https://kubernetes-sigs.github.io/node-feature-discovery/charts   9s    True    stored artifact: revision 'sha256:352b59241a37b01d7418325c96e8d2c596661b2a0d99280c4b19353b2ddbd1f2'
➜  gitops-playground git:(main) 

Flux uses the Helm SDK to fetch the Helm repository index, can't see why it would handle this differently.

[stefanprodan]

The error does not come from the Repository reconciler, but from the chart reconciler.

[matheuscscp]

Oh, right! @Hexoplon Can you please also paste your HelmChart manifest?