helm/helm · error

missing registry client: %w

Error message

missing registry client: %w

What it means

Returned by `helm dependency build` when newRegistryClient fails to construct the OCI registry client. Despite the wording, a client is always attempted — construction fails because TLS material could not be assembled (--cert-file/--key-file pair or --ca-file unreadable/invalid → 'can't create TLS config for client') or registry.NewClient rejected options such as an unusable credentials file at HELM_REGISTRY_CONFIG. The underlying cause is chained via %w.

Source

Thrown at pkg/cmd/dependency_build.go:65

	cmd := &cobra.Command{
		Use:   "build CHART",
		Short: "rebuild the charts/ directory based on the Chart.lock file",
		Long:  dependencyBuildDesc,
		Args:  require.MaximumNArgs(1),
		RunE: func(_ *cobra.Command, args []string) error {
			chartpath := "."
			if len(args) > 0 {
				chartpath = filepath.Clean(args[0])
			}
			sourceDateEpoch, err := sourceDateEpochFromEnv()
			if err != nil {
				return err
			}
			registryClient, err := newRegistryClient(out, client.CertFile, client.KeyFile, client.CaFile,
				client.InsecureSkipTLSVerify, client.PlainHTTP, client.Username, client.Password)
			if err != nil {
				return fmt.Errorf("missing registry client: %w", err)
			}

			man := &downloader.Manager{
				Out:              out,
				ChartPath:        chartpath,
				Keyring:          client.Keyring,
				SkipUpdate:       client.SkipRefresh,
				Getters:          getter.All(settings),
				RegistryClient:   registryClient,
				RepositoryConfig: settings.RepositoryConfig,
				RepositoryCache:  settings.RepositoryCache,
				ContentCache:     settings.ContentCache,
				Debug:            settings.Debug,
				SourceDateEpoch:  sourceDateEpoch,
			}
			if client.Verify {
				man.Verify = downloader.VerifyIfPossible
			}

View on GitHub (pinned to 2a29f1770b)

Solutions

1. Read the wrapped error — 'can't create TLS config for client' means bad/unreadable --cert-file/--key-file/--ca-file
2. Verify each TLS file exists and parses: openssl x509 -in ca.crt -noout (and similar for key pair)
3. Check HELM_REGISTRY_CONFIG (default ~/.config/helm/registry.json) is a readable, valid file
4. Retest with the TLS flags omitted to isolate whether flags or the credentials file is at fault

Example fix

# before
$ helm dependency build --ca-file ./certs/old-ca.pem
Error: missing registry client: can't create TLS config for client: open ./certs/old-ca.pem: no such file or directory

# after
$ openssl x509 -in ./certs/ca.pem -noout # verify it exists/parses
$ helm dependency build --ca-file ./certs/ca.pem

for _, f := range []string{client.CertFile, client.KeyFile, client.CaFile} {
	if f == "" { continue }
	if _, err := os.Stat(f); err != nil {
		return fmt.Errorf("TLS file %s unusable: %w", f, err)
	}
}

if err := buildCmd.Execute(); err != nil {
	if strings.Contains(err.Error(), "missing registry client") {
		// unwrap chain: TLS config error → fix cert/key/ca files; otherwise check registry credentials file
	}
}

When it happens

Trigger: helm dependency build --ca-file /missing/ca.crt; --cert-file/--key-file where only one of the pair is given with a caFile but files are malformed; HELM_REGISTRY_CONFIG pointing to a corrupt or unreadable JSON credentials file; permission errors reading client TLS files.

Common situations: Private registry setups in CI passing stale cert paths after secret rotation; containers missing mounted TLS secrets; HELM_REGISTRY_CONFIG pointed at a directory or empty invalid file; expired client certificates that no longer parse.

Related errors

• missing registry client: %w
• missing registry client: %w
• missing registry client: %w
• can't create TLS config for client: %w
• missing registry client: %w

AI-assisted analysis of helm/helm@2a29f1770b (2026-08-15). Data as JSON: /api/errors/003ac7e544a6fb10. Report an issue: GitHub.