Priority: 3 - High
Affects Version/s: 7.18.6
Fix Version/s: None
If a user doesn't have read permissions for one (or more) repositories under the virtual repository, this can break the metadata calculation, depends on the resolution order.
Steps to reproduce:
1. Create 3 local Helm repositories and 1 Virtual helm repository (helm1, helm2, helm3, and helm)
2. Deploy 3 different charts (chart_a, chart_b, chart_c) to helm1, helm2, helm3 accordingly.
3. Create a new user (user1) with read permission for helm1 and helm3 (no permission at all for helm2)
4. Verify that the resolution order is: helm1 -> helm2 -> helm3
5. $ helm repo add <JFROG_URL>/artifactory/helm --username user1 --password <password>
6. Review the cached index.yaml file (~/Library/Caches/helm/repository) it will list the chart only from helm1 but not from helm3.
The virtual repository index.yaml file should contain the charts from all the repositories according to the permissions. user1 should see charts from helm1 and helm3.
The resolution order in combination with different permission levels breaks the virtual repository aggregation functionality. user1 will only see charts from helm1 but not helm3.