helm pull: Usage, Options & Common CI Errors
Download a chart locally - to vendor, inspect, or repackage.
helm pull (formerly helm fetch) downloads a chart archive without installing it. In CI it vendors third-party charts for air-gapped or reproducible builds and lets you inspect or repackage a chart offline.
What it does
helm pull CHART downloads the chart .tgz to the working directory. --untar extracts it; --version pins a specific version; --destination chooses the output directory. It works against helm-repo-add repositories and OCI registries (oci:// references), and --verify checks a provenance signature.
Common usage
helm pull bitnami/nginx --version 15.0.0
helm pull bitnami/nginx --untar --untardir ./vendor
helm pull oci://registry-1.docker.io/bitnamicharts/nginx --version 15.0.0
helm pull internal/web --destination ./distCommon errors in CI
"Error: failed to fetch ... 401 Unauthorized" against an OCI registry means you have not run helm registry login (or the token expired). Log in before pulling private OCI charts in CI. "chart \"X\" version \"Y\" not found" means the version is absent from the cached index (run helm repo update) or you used a repo name for an OCI chart - OCI charts need the full oci:// URL, not a repo alias. For air-gapped CI, pull and vendor charts at a pinned version so the build does not depend on the upstream repo being reachable.