helm: add authentication support to Helm repository operations

[Athang69]

Summary

This PR adds authentication support to Helm repository add and update operations by extending AddUpdateRepoRequest to include auth fields supported by helm.sh/helm/v3/pkg/repo.Entry.

Changes

• Extended AddUpdateRepoRequest struct with username, password, insecureSkipTLSverify, and passCredentialsAll fields. certFile, keyFile, and caFile are intentionally omitted as accepting filesystem paths from HTTP clients would allow arbitrary local file reads on the server; these values are preserved from the existing repo entry only.
• Added Validate() method to AddUpdateRepoRequest to reject empty name or url with HTTP 400.
• Updated addRepository to accept the full request struct and pass auth fields to repo.Entry.
• Updated UpdateRepository to accept the full request struct, preserve existing auth fields, and return HTTP 404 if the named repository does not exist.
• Lowercased updateRepositoryWithRequest to keep it unexported since there are no external callers outside this file.
• Added applyRequestFields helper to apply optional auth fields to a repo.Entry.
• Added findRepoEntry helper to look up an existing repo entry by name.
• Fixed createFileIfNotThere to properly close the file handle and propagate non-IsNotExist errors from os.Stat.
• Fixed ListRepo and AddRepo handlers to buffer the JSON response before writing headers, preventing malformed responses on encode errors.
• Fixed log message in RemoveRepository to pass the repository name via structured metadata instead of as the message string.

Steps to Test

1. Run the backend with Helm enabled: HEADLAMP_CONFIG_ENABLE_HELM=true ./headlamp-server
2. Send a POST request to the add repo endpoint with username and password fields in the body.
3. Confirm the repository is added and the credentials are stored in the Helm repo config file.
4. Send a PUT request to the update repo endpoint without auth fields and confirm the existing credentials are preserved.
5. Send a PUT request with a repo name that does not exist and confirm a 404 is returned.
6. Run go test -v -p 1 ./pkg/helm/... and confirm all tests pass.

Notes for the Reviewer

• All new auth fields are optional. Requests that omit them get zero-value defaults, so there is no breaking change to existing callers.
• addRepository is unexported so its signature change has no impact outside this file.
• updateRepositoryWithRequest is unexported. UpdateRepository remains the single exported function and delegates to it.
• certFile, keyFile, and caFile are not accepted from the HTTP request body. This is a deliberate security decision to prevent server-side path traversal via authenticated API calls.
• TestListChart was already failing before this PR due to a missing local Helm cache file. This PR does not introduce or fix that failure.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Athang69
Once this PR has been reviewed and has the lgtm label, please assign sniok for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR extends the backend Helm repository add/update endpoints to support Helm repository authentication and TLS-related settings by plumbing additional request fields through to helm.sh/helm/v3/pkg/repo.Entry.

Changes:

• Expanded AddUpdateRepoRequest to include username/password and TLS/auth-related fields supported by Helm’s repo.Entry.
• Updated repository add/update flows to pass the full request through to Helm’s repository entry creation/update.

Comments suppressed due to low confidence (1)

backend/pkg/helm/repository.go:141

• This PR introduces persisted credentials (e.g., Password, TLS key material) in the Helm repo config, but the file is written with defaultNewConfigFileMode (currently 0644). That makes credentials world-readable on multi-user systems. Use a restrictive mode (e.g., 0600) when writing/creating the repo config (and consider tightening the directory mode as well).

	repoFile.Update(newRepo)

	err = repoFile.WriteFile(settings.RepositoryConfig, defaultNewConfigFileMode)
	if err != nil {

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

[Athang69]

@sniok @illume
In the copilot reviews the nolint:gosec directive is intentional. gosec G117 flags json.Marshal because the struct contains a Password field. These are test-only credentials used to verify that auth fields are correctly passed through to the Helm repo entry. There are no real secrets here.

[Athang69]

@sniok @illume I’d appreciate your review of this PR, especially to confirm whether the approach looks good to you.

[skoeva]

hi, could you squash the linting fixes into one atomic commit? and make sure to address the failing test in the CI

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Athang69]

Hi @skoeva I’ve squashed the linting fixes into a single atomic commit as requested and also fixed the failing CI test
Please take a look at the changes and let me know if you'd like me to change anything further.
Thanks!

[Athang69]

@illume Resolved the copilot's review PTAL.
Thanks!!

[Athang69]

@illume For the flaky fuzz test I have raised #5683 PTAL.
Thankss!

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[illume]

Thanks for working on this.

Would you mind addressing the open Copilot review comments? Please mark each comment as resolved after addressing it.

[Athang69]

@illume The exported UpdateRepository function is only called from its own HTTP handler within the same file with no external callers in the codebase, so no deprecation cycle is needed. The godoc has been updated to document the new 404 behavior explicitly so any future external caller is aware
All other copilot reviews are fixed PTAL.
Thanks!!

[illume]

Thank you.

It's looking very good now.

Just left a few notes about some missing function docs. I think after that it looks good to go.

[Athang69]

@illume Added doc comments PTAL.
Thanks!!

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.