Is in planned for GitHub - SonarSource/helm-chart-sonarqube to be published to an OCI compatible registry (Like GitHub packages, DockerHub etc…) for chart distribution?
OCI is becoming the facto the standard for Helm charts distribution and many other public chart have already provided their package to an OCI registry in addition to the default “index.yaml” deployment (bitnami, grafana, jenkins, codecentric, sigstore. etc… And many other).
Could SonarQube helm chart be deployed also to an OCI registry ?
It’s been a while since this was discussed but thought it worth bringing up again.
The biggest advantages for end-users like me are performance and ease-of-use. I’ve seen a noticeable speedup when pulling a chart from OCI versus any traditional repository, where helm needs to read an (often quite large) index.yaml file. The fact I can authenticate with the registry using my own credentials for Docker Hub/GitHub/etc. is a nice bonus.
As noted by Valentin in another request, chart signing/provenance is much easier to implement with OCI, as charts are treated with the same artifact model as images. This means you can tie charts into the software supply chain in the same way as images and SBOM.
Sonar images are stored in Docker Hub, while charts are hosted on GitHub pages. You’re therefore likely to be choosing between gchr or docker hub as your registry of choice.
As a final thought, the Helm docs explicitly recommend OCI registries over traditional repositories - Use OCI-based registries | Helm. Both are still supported but I can image a future version of helm where support for the latter is dropped entirely.