Download a chart locally - to vendor, inspect, or repackage.
helm pull (formerly helm fetch) downloads a chart archive without installing it. In CI it vendors third-party charts for air-gapped or reproducible builds and lets you inspect or repackage a chart offline.
What it does
helm pull CHART downloads the chart .tgz to the working directory. --untar extracts it; --version pins a specific version; --destination chooses the output directory. It works against helm-repo-add repositories and OCI registries (oci:// references), and --verify checks a provenance signature.
"Error: failed to fetch ... 401 Unauthorized" against an OCI registry means you have not run helm registry login (or the token expired). Log in before pulling private OCI charts in CI. "chart \"X\" version \"Y\" not found" means the version is absent from the cached index (run helm repo update) or you used a repo name for an OCI chart - OCI charts need the full oci:// URL, not a repo alias. For air-gapped CI, pull and vendor charts at a pinned version so the build does not depend on the upstream repo being reachable.
Using this in CI
A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.
Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods
# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info
# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
Frequently asked questions
helm pull: Usage, Options & Common CI Errors?
helm pull (formerly helm fetch) downloads a chart archive without installing it. In CI it vendors third-party charts for air-gapped or reproducible builds and lets you inspect or repackage a chart offline.
What it does?
helm pull CHART downloads the chart .tgz to the working directory. --untar extracts it; --version pins a specific version; --destination chooses the output directory. It works against helm-repo-add repositories and OCI registries (oci:// references), and --verify checks a provenance signature.
Common errors in CI?
"Error: failed to fetch ... 401 Unauthorized" against an OCI registry means you have not run helm registry login (or the token expired). Log in before pulling private OCI charts in CI. "chart \"X\" version \"Y\" not found" means the version is absent from the cached index (run helm repo update) or you used a repo name for an OCI chart -
