Repository navigation
Support for invoking a password-supplying command #32836
Description
What would you like to be added?
Hello,
FYI, Helm stores my personal password in clear in the
file ~/.config/helm/repositories.yaml
This is a known Helm issue since 2018 and it has never been really
solved: #4723
At the moment, the secure way is not user-friendly: invoke helm with
the --password-stdin commandline option, and piping the secret in.
(Putting a secret as a commandline parameter is not secure, as it
would be visible by anyone else on the system with e.g. "ps -ef")
I would certainly prefer a configfile setting where we can specify a
command helm could run and get its stdout. This would be both easy to
implement and generically usable with whatever password store is in
use. In the repositories.yaml file, it could be something like:
password_command: "pass show the_password"
Could you please consider implementing such a feature?
Thanks a lot!
Best regards
Fabrice
Why is this needed?
End users should not have to choose between security and convenience. The helm commandline should remain simple, and no password should be stored in clear.
Activity
feat(repo): support password_command for repository authentication (h…
irajatpandey commentedon Nov 7, 2026
Hi @fbauzac,
I have submitted PR #32861 implementing support for
password_command:--password-commandtohelm repo add, enforcing mutual exclusivity with--passwordand--password-stdin.sh -con Unix,cmd.exe /con Windows), trims trailing newlines, and bounds execution with a 30s timeout.repositories.yamlpreservespassword_commandwhile leaving thepasswordfield empty.repositories.yamlor via--passwordcontinue to work with zero overhead.Feel free to take a look and share any feedback!
irajatpandey commentedon Nov 10, 2026
/assign
irajatpandey commentedon Nov 10, 2026
Gentle ping to maintainers (@TerryHowe, @gjenkins8, @joejulian, @marckhouzam, @mattfarina):
PR #32861 is open and ready for review to resolve this issue. All CI checks and DCO validations have passed, unit tests are included, and full backwards compatibility is preserved.
Whenever you have a moment, could someone please take a look? Thank you!
irajatpandey commentedon Nov 11, 2026
/assign