# helm pull: Usage, Options & Common CI Errors

> helm pull downloads a chart archive from a repo or OCI registry. Untarring for vendoring, OCI auth, and the chart-not-found and login errors in CI.

Source: https://latchkey.dev/learn/command-reference/helm-pull-command  
Updated: 2026-06-25

Download a chart locally - to vendor, inspect, or repackage.

helm pull (formerly helm fetch) downloads a chart archive without installing it. In CI it vendors third-party charts for air-gapped or reproducible builds and lets you inspect or repackage a chart offline.

## What it does

helm pull CHART downloads the chart .tgz to the working directory. --untar extracts it; --version pins a specific version; --destination chooses the output directory. It works against helm-repo-add repositories and OCI registries (oci:// references), and --verify checks a provenance signature.

## Common usage

```Terminal
helm pull bitnami/nginx --version 15.0.0
helm pull bitnami/nginx --untar --untardir ./vendor
helm pull oci://registry-1.docker.io/bitnamicharts/nginx --version 15.0.0
helm pull internal/web --destination ./dist
```

## Common errors in CI

"Error: failed to fetch ... 401 Unauthorized" against an OCI registry means you have not run helm registry login (or the token expired). Log in before pulling private OCI charts in CI. "chart \"X\" version \"Y\" not found" means the version is absent from the cached index (run helm repo update) or you used a repo name for an OCI chart - OCI charts need the full oci:// URL, not a repo alias. For air-gapped CI, pull and vendor charts at a pinned version so the build does not depend on the upstream repo being reachable.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### helm pull: Usage, Options & Common CI Errors?

helm pull (formerly helm fetch) downloads a chart archive without installing it. In CI it vendors third-party charts for air-gapped or reproducible builds and lets you inspect or repackage a chart offline.

### What it does?

helm pull CHART downloads the chart .tgz to the working directory. --untar extracts it; --version pins a specific version; --destination chooses the output directory. It works against helm-repo-add repositories and OCI registries (oci:// references), and --verify checks a provenance signature.

### Common errors in CI?

"Error: failed to fetch ... 401 Unauthorized" against an OCI registry means you have not run helm registry login (or the token expired). Log in before pulling private OCI charts in CI. "chart \"X\" version \"Y\" not found" means the version is absent from the cached index (run helm repo update) or you used a repo name for an OCI chart -

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt