kustomize-build step should support private OCI helmCharts

[jessesuen]

Proposed Feature

My preferred way of deploying helm charts is via kustomized helm. e.g.:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

helmCharts:
- name: guestbook
  releaseName: guestbook
  version: 1.2.3
  repo: oci://us-docker.pkg.dev/example/guestbook/charts
  valuesFile: values.yaml

The challenge is if repo is a private repo and needs image credentials, the kustomize build will fail in kargo.

On a workstation it works if your environment is logged into the private image repo. I believe this works because the helm command will know to use credentials from ~/.docker/config.json in order to authenticate to the remote registry. We need to make it possible for this to work in promotion.

Motivation

Kustomize is not fully functional to workstation capabilities.

Suggested Implementation

For the kustomize build command, we could set the ~/.docker/config.json so that helm will work. But this should not be done globally, obviously since would mean all projects could access it, so we need to be mindful of how to do this securely.

[jessesuen]

This is similar to #2477, but for helm

[jessesuen]

It should be noted that kustomize itself lacks the feature to pass credentials:
kubernetes-sigs/kustomize#4335

But I think the above issue applies to HTTP repos and we could still do something for OCI, which IMO is becoming the trend/norm.

[jessesuen]

we could set the ~/.docker/config.json so that helm will work
we need to be mindful of how to do this securely.

I bet we could populate a temporary and randomized directory for the duration of the kustomize-build step containing the project image credentials, and then set DOCKER_CONFIG to it.

[hiddeco]

Helm maintains its own set of credentials, i.e. logging in to helm registry login holds a different set of credentials than what you have logged into via docker. These credentials are however stored and read from in Helm's config home directory, and we should be able to prepare both HTTP/S and OCI credentials by writing them to the expected (temporary) Helm paths before we hand this over to Kustomize.

[hiddeco]

Something to take into account is that we are currently also preparing credentials for the helm-update-chart step, and it may be beneficial to factor this out so it can work for this step and kustomize-build.