looks like %q is not a valid chart repository or cannot be r

Error message

looks like %q is not a valid chart repository or cannot be reached: %w

What it means

FindChartInAuthAndTLSAndRepoURL wraps a failed DownloadIndexFile: the repository's index.yaml could not be fetched. The wrapped error carries the real cause - DNS failure, connection refused, 404 on index.yaml, TLS verification failure, or an auth error.

Source

Thrown at pkg/repo/v1/chartrepo.go:203

	c := Entry{
		URL:                   repoURL,
		Username:              opts.Username,
		Password:              opts.Password,
		PassCredentialsAll:    opts.PassCredentialsAll,
		CertFile:              opts.CertFile,
		KeyFile:               opts.KeyFile,
		CAFile:                opts.CAFile,
		Name:                  name,
		InsecureSkipTLSVerify: opts.InsecureSkipTLSVerify,
	}
	r, err := NewChartRepository(&c, getters)
	if err != nil {
		return "", err
	}
	idx, err := r.DownloadIndexFile()
	if err != nil {
		return "", fmt.Errorf("looks like %q is not a valid chart repository or cannot be reached: %w", repoURL, err)
	}
	defer func() {
		os.RemoveAll(filepath.Join(r.CachePath, helmpath.CacheChartsFile(r.Config.Name)))
		os.RemoveAll(filepath.Join(r.CachePath, helmpath.CacheIndexFile(r.Config.Name)))
	}()

	// Read the index file for the repository to get chart information and return chart URL
	repoIndex, err := LoadIndexFile(idx)
	if err != nil {
		return "", err
	}

	errMsg := fmt.Sprintf("chart %q", chartName)
	if opts.ChartVersion != "" {
		errMsg = fmt.Sprintf("%s version %q", errMsg, opts.ChartVersion)
	}
	cv, err := repoIndex.Get(chartName, opts.ChartVersion)
	if err != nil {

View on GitHub (pinned to 2a29f1770b)

Solutions

Read the wrapped error text - it names the exact cause (DNS, TLS, 404, timeout, auth)
Verify reachability directly: `curl -f <repoURL>/index.yaml` (add -k or --cacert as appropriate)
Fix the stored URL: `helm repo remove <name>` and `helm repo add <name> <correct-url>`, then `helm repo update`
For TLS issues pass --ca-file / --insecure-skip-tls-verify; for proxied networks export HTTPS_PROXY

Defensive patterns

Strategy: retry

Try / catch

var chartURL string
err := retry.Do(func() error {
	var e error
	chartURL, e = client.ChartRepository.FindChartInRepoURL(...) // or repo.FindChartInAuthAndTLSAndRepoURL
	return e
}, retry.Attempts(3), retry.Delay(2*time.Second), retry.DelayType(retry.BackOffDelay))
if err != nil {
	var inner error = err
for {
	if u := errors.Unwrap(inner); u != nil {
		inner = u
	} else {
		break
	}
}
	// inner now carries the true network cause (DNS/TLS/404/auth) for diagnostics
}

Prevention

Pre-flight check `curl -f <repoURL>/index.yaml` before running jobs that resolve charts
Wrap repo operations in bounded retry with backoff for transient network faults
Pin --ca-file for private CAs and export HTTPS_PROXY in corporate networks

When it happens

Trigger: Chart resolution (helm pull/show/install from a named repo) when the repo host is unreachable, index.yaml returns 404/401, the server uses self-signed TLS without --ca-file, or a proxy blocks the request.

Common situations: Stale or wrong repo URL after the repo moved; corporate proxies requiring HTTPS_PROXY; self-hosted repos with self-signed certificates; offline/air-gapped environments; expired auth tokens for private repos.

Related errors

AI-assisted analysis of helm/helm@2a29f1770b (2026-08-15). Data as JSON: /api/errors/3edf54a58549f749. Report an issue: GitHub.