Add OCI publishing for Helm charts to GHCR

[willianpaixao]

Pull Request Description

What type of PR is this?

/kind feature
/area helm-charts
/area cluster-autoscaler

What this PR does / why we need it:

This PR adds OCI (Open Container Initiative) publishing for Helm charts to GitHub Container Registry (GHCR).

Helm 3.8+ supports OCI-based chart distribution as a GA feature, and many CNCF projects have adopted this approach (e.g., prometheus-community/helm-charts). This provides users with an alternative installation method that doesn't require adding a Helm repository first.

Changes:

• Updated .github/workflows/chart-release.yaml to push charts to GHCR after release
• Upgraded Helm from v3.4.0 to v3.19.2 (OCI support requires 3.8+)
• Added packages: write permission for GHCR access
• Updated chart READMEs with OCI installation instructions

After this change, users can install charts via:

helm install my-release oci://ghcr.io/kubernetes/charts/cluster-autoscaler
helm install my-release oci://ghcr.io/kubernetes/charts/vertical-pod-autoscaler

The classic Helm repository continues to work alongside OCI.

Which issue(s) this PR fixes:

Fixes #7086

Special notes for your reviewer:

• The implementation follows the pattern used by prometheus-community/helm-charts
• No changes to chart structure or content are required
• Uses the existing GITHUB_TOKEN secret already available in the workflow

Does this PR introduce a user-facing change?

Helm charts are now published as OCI artifacts to ghcr.io/kubernetes/charts. Users with Helm can install charts directly via `helm install my-release oci://ghcr.io/kubernetes/charts/cluster-autoscaler` without adding a Helm repository first.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

• Helm OCI Support
• Chart Releaser Action

[k8s-ci-robot]

Welcome @willianpaixao!

It looks like this is your first PR to kubernetes/autoscaler 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/autoscaler has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @willianpaixao. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

This PR adds OCI (Open Container Initiative) publishing support for Helm charts to GitHub Container Registry (GHCR), enabling users to install charts directly without adding a Helm repository first. The implementation upgrades the Helm version to support OCI features and adds new workflow steps to push released charts to GHCR.

Key changes:

• Added OCI publishing workflow steps with GHCR authentication and chart push logic
• Upgraded Helm from v3.4.0 to v3.19.2 and updated GitHub Actions dependencies
• Updated chart READMEs with OCI installation instructions alongside existing Helm repository method

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/chart-release.yaml	Added GHCR login and chart push steps for both CA and VPA jobs; upgraded action versions and Helm version; added packages: write permission
cluster-autoscaler/charts/cluster-autoscaler/README.md	Added "Using OCI Registry" section with helm install examples for both autodiscovery and manual configuration methods
vertical-pod-autoscaler/charts/vertical-pod-autoscaler/README.md	Added "Installation" section with both Helm repository and OCI registry installation methods

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[willianpaixao]

/assign gjtempleton

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: willianpaixao
Once this PR has been reviewed and has the lgtm label, please ask for approval from gjtempleton. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adrianmoisey]

I see that the container registry is per "owner" (ie, in our case that would be kubernetes, not kubernetes/autoscaler)

I have no idea what the permission model is around that

[willianpaixao]

We need to find out whether the kubernetes org allows workflows to create new packages. This is controlled by the org's "Packages" settings. If package creation is restricted, the first push would fail and we'd need an org admin to either pre-create the package or adjust the org settings.

I can add a note in the PR description about this, or we could do a test run with workflow_dispatch to verify it works before merging. What do you think?

[adrianmoisey]

@jackfrancis what are your thoughts on this? I like it, but I don't know if we have permission to do it.

[k8s-ci-robot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.