Resolved

FluxCD OCIRepository fails with unsupported protocol scheme oci error

FluxCD
Kubernetes
Helm
OCI
DevOps
GitOps
Namespace
CI/CD

HelmRelease failing with chart pull error when OCIRepository is created in application namespace instead of flux-system | FluxCD requires OCI sources in flux-system namespace for proper chart resolution

The project addressed a FluxCD GitOps pipeline issue where an OCIRepository resource was incorrectly placed in an application namespace, causing HelmRelease failures due to an unsupported protocol scheme 'oci' error. This prevented the system from pulling and deploying the Redis chart via Helm.

Issue

The HelmRelease for Redis failed to pull the chart, resulting in the error unsupported protocol scheme 'oci'. This occurred during FluxCD reconciliation, blocking the deployment of Redis and dependent components in the GitOps pipeline. The error prevented the source-controller from discovering and processing the OCI-based chart.

Culprit

The issue arose because the OCIRepository resource was inadvertently created in the redis-system namespace due to a configuration in the kustomization.yaml file. This namespace was intended for application resources but not for FluxCD’s source-controller, which requires OCIRepository resources to reside in the flux-system namespace. The mismatch prevented the source-controller from discovering and processing the OCI chart source, resulting in the chart pull failure.

Solution

Namespace Separation

The solution involved separating the OCIRepository resource into a dedicated configuration file and explicitly assigning it to the flux-system namespace. This ensured that the source-controller, which operates in the flux-system namespace, could discover and process the OCI chart.

Cross-Namespace Reference

The HelmRelease was updated to reference the OCIRepository across namespaces. This allowed the HelmRelease in the redis-system namespace to access the OCI chart from the flux-system namespace, enabling proper chart resolution and deployment.

Kustomization Update

The kustomization.yaml file was updated to include the new OCIRepository file, ensuring that the resource was correctly applied to the flux-system namespace.

Architecture Pattern

This approach followed FluxCD’s standard multi-tenant architecture:

  1. Chart sources (e.g., OCIRepository, HelmRepository) are placed in the flux-system namespace.
  2. HelmReleases are deployed in application-specific namespaces (e.g., redis-system).
  3. Cross-namespace references are used to allow HelmReleases to access chart sources from the flux-system namespace.

This solution resolved the HelmRelease failure by ensuring that the OCI chart was correctly discovered and pulled by the source-controller, enabling seamless deployment within the GitOps pipeline.