ARTIFACTORY: How to Fix the “401 Unauthorized” Error in the Helm Client

In some cases, even after adding a Helm repository to the Helm client using valid credentials, attempts to pull charts may fail with a “401 Unauthorized” error. This issue commonly occurs due to a mismatch between the Helm repository URL added to the client and the chart download URLs referenced in the repository metadata.

Root Cause

The Helm client treats URLs with and without an explicit port number as different endpoints. In certain Artifactory configurations, chart URLs defined in the index.yaml metadata file may include port 443, while the repository URL added to the Helm client does not.
This behavior is typically influenced by the X-JFrog-Override-Base-Url header configured in the reverse proxy. If the reverse proxy appends port 443 to the base URL, Artifactory propagates this value into the Helm repository metadata, causing an authentication mismatch.

Example Scenario

Add the Helm Repository

helm repo add helm-virtual \
  https://artifactory.example.com/artifactory/api/helm/helm-virtual \
  --username <user> \
  --password <token>

 

Attempt to Pull a Chart

helm pull helm-virtual/trident-protect --version 100.2410.1

 

Error Encountered

Error: failed to fetch https://artifactory.example.com:443/artifactory/api/helm/helm-virtual/charts/trident-protect-100.2410.1.tgz : 401 Unauthorized

 

In this example, the Helm client added the repository using https://artifactory.example.com, while the chart URL referenced in index.yaml includes https://artifactory.example.com:443, resulting in a credentials mismatch.

Resolution 

Option 1: Update Reverse Proxy Configuration (Recommended)
Modify the reverse proxy configuration to ensure that the base URL does not explicitly include port 443.
Current configuration:

proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$server_port;

Updated configuration:

proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host;

 

This ensures consistency between the repository URL and the chart URLs generated in the Helm metadata.

Option 2: Add the Helm Repository with Port 443
Alternatively, add the Helm repository to the Helm client using an explicit port number:

helm repo add helm-virtual \
  https://artifactory.example.com:443/artifactory/api/helm/helm-virtual \
  --username <user> \
  --password <token>

 

This aligns the repository URL with the chart URLs referenced in index.yaml.

Handling Redirected URLs

If the Artifactory URL redirects requests to another endpoint, Helm may not pass authentication credentials to the redirected URL by default. In such cases, add the --pass-credentials flag when registering the repository:

helm repo add helm-virtual \
  https://artifactory.example.com/artifactory/api/helm/helm-virtual \
  --username <user> \
  --password <token> \
  --pass-credentials

Note:

The --pass-credentials flag sends credentials to all redirected URLs. Ensure that the target URLs are trusted and accessed over HTTPS.