Repository navigation
Add more public Helm chart repositories to the egress allowlist (Istio, Temporal, AWS EKS, Kubernetes, ...) #327
Description
Several public Helm chart repositories are still blocked by the egress allowlist (egress not allowlisted <host> / 403). Helm update jobs report No update possible for charts from them and don't raise an error. Dependabot also closes existing PRs for those charts as "no longer updatable". This follows #314 / #318 (Datadog, HashiCorp, Teleport, Wiz), which fixed those hosts for us. Thank you!
proxy | GET https://blob.istio.io:443/istio-release/charts/index.yaml
proxy | * egress not allowlisted blob.istio.io
proxy | 403 https://blob.istio.io:443/istio-release/charts/index.yaml
updater | INFO Latest version is
updater | INFO No update possible for base 1.31.1
| Host | Chart repo | Notes |
|---|---|---|
blob.istio.io |
https://blob.istio.io/istio-release/charts |
Istio's current repo URL; 308 to istio-release.r2.istio.io; tarball URLs are relative |
istio-release.r2.istio.io |
redirect target of blob.istio.io |
|
istio-release.storage.googleapis.com |
Istio's legacy repo URL (being retired) | |
temporalio.github.io |
https://temporalio.github.io/helm-charts |
301 to go.temporal.io (CNAME to temporalio.github.io) |
go.temporal.io |
redirect target of temporalio.github.io |
|
aws.github.io |
https://aws.github.io/eks-charts |
|
kubernetes.github.io |
https://kubernetes.github.io/autoscaler |
kubernetes-sigs.github.io is already allowed |
cloudflare.github.io |
https://cloudflare.github.io/helm-charts |
|
stakater.github.io |
https://stakater.github.io/stakater-charts |
|
mend.github.io |
https://mend.github.io/renovate-ce-ee |
|
scalr.github.io |
https://scalr.github.io/agent-helm |
|
charts.js.wiki |
https://charts.js.wiki |
Each serves a public index.yaml (200). Tarballs are on the same host or on github.com. All of these are exact, vendor-controlled hosts. Could they be added to ecosystem_default_domains.helm?
Activity