# Proxy and cache Helm charts with Artifactory

URL: https://chainguard-docs-preview-git-fix-learning-lab-jsonld.chainguard.app/chainguard/containers/using-and-deploying/helm-charts/proxy-and-cache.md
Last Modified: September 28, 2026
Tags: Chainguard Containers, Helm charts, Artifactory, iamguarded, Product

Use Artifactory to proxy and cache Chainguard iamguarded Helm charts


This page shows you how to set up and use Chainguard Helm Charts with Artifactory via remote Helm OCI repositories.

## Create and configure Helm OCI repository in Artifactory

In Artifactory's **Administration** module, select **Repositories**, then **Create a Repository**, and choose **Remote**. Set the package type to **Helm** and give the repository a key (name); this guide uses `iamguarded-charts`. For the full list of settings, refer to JFrog's [remote repositories documentation](https://docs.jfrog.com/artifactory/docs/remote-repositories).

To determine values for the `User Name` and `Password / Access Token` fields, run the following command:

```bash
chainctl auth configure-docker --pull-token --save
```

Output will look like this:

```bash
To use this pull token in another environment, run this command:

    docker login "cgr.dev" --username "<identity-id>" --password "<pull-token>"
```

In the repository's configuration, set the **URL** to `https://cgr.dev`, and set the **User Name** and **Password / Access Token** to the values from the command output above.

Once created, the next step is to configure Helm to pull from the mirrored repository. We can then test that it works by pulling the Helm Chart from the repository.

## Configure Helm to pull from the mirrored repository and install

> **NOTE:** In the following example, $JFROG_USERNAME and $JFROG_TOKEN refer to the Artifactory username and token used to gain access to the newly created Helm repository. For testing purposes, a quick way to generate this against any repository is by using the "Set Me Up" button in the top right corner of the UI.

```bash
JFROG_USERNAME= # Your username, i.e. username@chainguard.dev
JFROG_TOKEN= # Your token
helm registry login -u $JFROG_USERNAME -p $JFROG_TOKEN chainguard.jfrog.io
Login Succeeded
helm pull oci://chainguard.jfrog.io/iamguarded-charts/YOUR-ORGANIZATION/iamguarded-charts/kafka
Pulled: chainguard.jfrog.io/iamguarded-charts/YOUR-ORGANIZATION/iamguarded-charts/kafka:32.2.18
Digest: sha256:8cc051f049fbd75cfc84306bf11adf0ef4ea0d19bc3a1d3ae46284b3aab5b083
```

Finally, we'll create a Kubernetes Secret that will be used to pull the `kafka-iamguarded` image from Artifactory and then run the `helm install` process.

> **NOTE:** Similar to the Helm example, `$JFROG_USERNAME` and `$JFROG_TOKEN` refer to the Artifactory username and token used to gain access to your existing remote repository used to mirror Chainguard images from your organization. This may be different than the credentials used to gain access to your remote Helm repository.

```bash
JFROG_USERNAME= # Your username, i.e. username@chainguard.dev
JFROG_TOKEN= # Your token
ORGANIZATION= # Your organization, i.e. YOUR-ORGANIZATION
kubectl create secret docker-registry chainguard-pull-secret \
    --docker-server=chainguard.jfrog.io \
    --docker-username=$JFROG_USERNAME \
    --docker-password=$JFROG_TOKEN

secret/chainguard-pull-secret created

helm install kafka oci://chainguard.jfrog.io/iamguarded-charts/YOUR-ORGANIZATION/iamguarded-charts/kafka \
    --set image.registry=chainguard.jfrog.io \
    --set image.repository=iamguarded-charts/YOUR-ORGANIZATION/iamguarded-charts/kafka \
    --set "global.org=$ORGANIZATION" \
    --set "global.imagePullSecrets[0].name=chainguard-pull-secret"

    Pulled: chainguard.jfrog.io/iamguarded-charts/YOUR-ORGANIZATION/iamguarded-charts/kafka:32.2.18
    Digest: sha256:8cc051f049fbd75cfc84306bf11adf0ef4ea0d19bc3a1d3ae46284b3aab5b083
    NAME: kafka
    LAST DEPLOYED: Fri Jul 11 15:10:56 2025
    NAMESPACE: default
    STATUS: deployed
    REVISION: 1
    TEST SUITE: None
    NOTES:
    CHART NAME: kafka
    CHART VERSION: 32.2.18
    APP VERSION: 4.0.0
```

A few things to note regarding the above values:

- The `global.org` value is set to the organization name you're pulling Helm Charts from.  This is specific to the Chainguard variant of the Helm Chart.
- The `global.imagePullSecrets[0].name` value is set to the name of the Kubernetes Secret that will be used to pull the `kafka-iamguarded` image from Artifactory (or whichever registry images are being pulled from, for non-Artifactory setups).