Oci login rotated credentials test

[jaumebalust]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No. This PR restores correct handling of user-supplied registry credentials on the helm_release Update path and adds a test that exercises
it; it does not introduce or modify access controls, encryption, or logging.

Description

Fixes a regression introduced in the 3.0.0 plugin-framework rewrite where helm_release.Update passes repository_username /
repository_password from the prior state to OCIRegistryLogin instead of from the current plan.

For registries that issue short-lived tokens (AWS Public ECR via data.aws_ecrpublic_authorization_token, Azure ACR, etc.), the
state-stored token has typically expired by the next terraform apply. The login call then fails with 401/403 even though the user's
configuration already contains a fresh token — the fresh token simply never reaches the login call. Create, ModifyPlan, and the
helm_template data source were already reading from plan/config and were not affected.

Changes:

• helm/resource_helm_release.go — in Update, pass plan.Repository / plan.Chart / plan.RepositoryUsername /
  plan.RepositoryPassword to OCIRegistryLogin instead of the state.* equivalents. One-line behavioral fix, cherry-picked from Fix repository authentication when updating a helm_release with temporary credentials #1687 with
  Kevin Frommelt as author.
• helm/resource_helm_release_test.go — new acceptance test TestAccResourceRelease_OCI_login_rotated_credentials that reproduces the
  regression end-to-end. It starts the existing Docker-based OCI registry with auth, applies a release with one set of credentials, swaps the
  registry's htpasswd between steps to simulate token rotation, then applies an Update with the new credentials and a changed set value.
  Also adds a small rotateOCIRegistryCredentials helper (uses docker cp; the distribution registry re-reads htpasswd per request so no
  restart is needed) and extends setupOCIRegistry to return the container name.
• helm/testdata/oci_registry/auth2.htpasswd — new fixture (hashicorp2:terraform2, bcrypt) used by the rotation step of the test.

Verified: without the Update-path fix the new test fails at Step 2 with an OCI login error; with the fix it passes. go vet ./helm/... and
gofmt are clean.

Acceptance tests

• Have you added an acceptance test for the functionality being added?

Release Note

resource/helm_release: fix OCI registry login on update to use credentials from the current plan instead of the prior state, so rotated
short-lived tokens (e.g. AWS Public ECR, Azure ACR) are honored on subsequent applies                                                       
 
References                                                                                                                                  
                                                          
- Supersedes #1687 (same one-line fix, authorship preserved via cherry-pick) and adds the acceptance test that PR was missing.              
- Fixes #1660 (OCI registry login failure against Azure ACR since 3.0.0).
- Fixes #1645 (OCI registry login 403 against AWS Public ECR with aws_ecrpublic_authorization_token).                                       
- Original concurrency/dedup design for OCI login introduced in #848 (9d162fb7), on which the current code path is based.                   
                                                                                                                                            
Community Note                                                                                                                              
                                                                                                                                            
- Please vote on this issue by adding a 👍 https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/ to the    
original issue to help the community and maintainers prioritize this request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

1 out of 2 committers have signed the CLA.

• kevinfrommelt
• jaumebalust

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[attilakozak-bb]

This issue is also encountered in a CI/CD pipeline using separate plan and apply jobs (GitLab CI with OpenTofu 1.11), authenticating to Azure Container Registry via workload identity to pull Helm charts from a private OCI registry.

Every available workaround has been attempted:

Method	Result
repository_username/repository_password on helm_release	Plan succeeds, apply fails with "OCI Registry Login Failed" (401 Unauthorized)
registries provider block with data "external" fetching a fresh token	Same — plan succeeds, apply fails
registries provider block with variables fed via dotenv artifact	Same — apply does not re-authenticate
Writing ~/.docker/config.json or ~/.config/helm/registry/config.json before running tofu	Provider ignores these files entirely for helm_release resources

Observed behavior

• tofu plan authenticates and resolves the chart successfully.
• tofu apply plan.tfplan fails with 401 Unauthorized even when a fresh, valid token is available.
• The provider appears to skip re-authentication to the OCI registry during the apply phase.

Impact

This is blocking the migration from static long-lived credentials to short-lived identity-based tokens. Any update on when this fix might be merged and released would be appreciated.

[attilakozak-bb]

@rigalGit — Could this PR get a review? It addresses a critical bug affecting multiple open issues (#1493, #1645, #1660) where OCI registry authentication fails during apply with a saved plan file. The bug has been open since v3.0.0 (June 2025) and is blocking teams from using short-lived identity-based tokens with OCI registries.

The PR has been open for over 2 months with no review activity. It may need a rebase — happy to help if the author is unavailable.

[jaumebalust]

I have signed the CLA multiple times but this #1780 (comment) doesn't get updated.

This should be the one that counts: #1780 (comment)