getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\"" #1160

dkirrane · 2018-10-15T10:29:49Z

Trying out the skaffold-jib support but hitting the following:

skaffold build

...

[INFO] Container entrypoint set to [java, -cp, /app/resources:/app/classes:/app/libs/*, com.demo.Application]
[INFO]
[INFO] Built and pushed image as nexus-mycompany.com/my-demo:efa216d171eacbc419bdb37164922744
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 18.920 s
[INFO] Finished at: 2018-10-15T11:03:11+01:00
[INFO] ------------------------------------------------------------------------
time="2018-10-15T11:03:12+01:00" level=fatal msg="build step: building [nexus-mycompany.com/my-demo]: getting digest: nexus-mycompany.com/my-demo:efa216d171eacbc419bdb37164922744: 
getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\""

Expected behavior

skaffold build completes sucessfully

Actual behavior

UNAUTHORIZED error

Information

Skaffold version: version: v0.16.0
Operating system: Windows 10 using latest GitBASH
Contents of skaffold.yaml:

apiVersion: skaffold/v1alpha4
kind: Config

build:
  artifacts:
  - image: nexus-mycompany.com/my-demo
    jibMaven: 
      profile: prod
  tagPolicy:
      gitCommit: {}

deploy:
  helm:
    releases:
    - name: my-demo
      chartPath: helm
      valuesFiles:
        - values.yaml
      wait: true
      namespace: default
      version: "1.0"

Steps to reproduce the behavior

create simple spring boot 2 app (version 2.0.5.RELEASE)
added jib maven plugin to pom.xml

            <plugin>
                <groupId>com.google.cloud.tools</groupId>
                <artifactId>jib-maven-plugin</artifactId>
                <version>0.9.11</version>
            </plugin>

skaffold build

The text was updated successfully, but these errors were encountered:

dgageot · 2018-10-15T12:00:46Z

ping @GoogleContainerTools/java-tools

briandealwis · 2018-10-15T12:45:16Z

~~@dkirrane how have you authenticated to your nexus registry? via docker login, or via ~/.m2/settings.xml? See the following section for authentication with Jib.~~ (That message is a skaffold error, not jib)

loosebazooka · 2018-10-15T14:40:24Z

It seems like this is step where skaffold is setting the tag. @coollog ? Skaffold's registry client might need auth info to the registry.

coollog · 2018-11-09T19:01:52Z

Yea, this looks to be a discrepancy between the auth info that Skaffold uses vs the auth info that Jib uses. @dkirrane - which authentication method are you using with Jib? (credential helper, settings.xml, or Docker login?)

dkirrane · 2018-11-14T14:41:31Z

I'm using settings.xml

<settings>
  ...
  <servers>
    ...
    <server>
      <id>nexus-mycompany.com</id>
      <username>MY_USERNAME</username>
      <password>MY_PASSWORD</password>
    </server>
  </servers>
</settings>

dkirrane · 2018-11-14T15:47:45Z

Also, I've update to skaffold v0.18.0 & jib 0.10.0
I tried switch to wincred credential helper (docker-credential-wincred.exe) as below

            <plugin>
                <groupId>com.google.cloud.tools</groupId>
                <artifactId>jib-maven-plugin</artifactId>
                <version>0.10.0</version>
                <configuration>                    
                    <to>
                        <image>${docker.image.prefix}/${project.artifactId}</image>
                        <credHelper>wincred</credHelper>
                    </to>
                </configuration>                
            </plugin>

mvn compile jib:build is successful but skaffold build fails with same error.

Is there some setting I'm missing to setup auth for skaffold?

coollog · 2018-11-19T19:55:24Z

I believe skaffold actually fetches auth from the Docker config in order to retag the image with the skaffold tagging method. Therefore, you would need to either do a docker login with your credentials or edit your Docker config to use your wincred credential helper. I believe you may want to set the credsStore:

{
  "credsStore": "wincred"
}

@GoogleContainerTools/java-tools We might want to look into potentially adding a Jib goal/task that can expose the credentials Jib uses to Skaffold to use with the tagging logic, or having Skaffold somehow pull the same credentials without needing a Docker config.

dgageot · 2019-01-19T23:59:51Z

Fixed with #548

briandealwis · 2019-01-25T01:02:10Z

Fixed by #1475

dkirrane · 2019-02-16T21:14:42Z

@dgageot @briandealwis - I'm still hitting this issue on skaffold v0.23.0. I'm obviously missing something but not sure what...

~/.docker/config.json

{
	"auths": {
		"https://index.docker.io/v1/": {},
		"nexus.mycompany.com": {}
	},
	"HttpHeaders": {
		"User-Agent": "Docker-Client/18.09.0 (windows)"
	},
	"credsStore": "wincred",
	"credHelpers": {
		"asia.gcr.io": "gcr",
		"eu.gcr.io": "gcr",
		"gcr.io": "gcr",
		"staging-k8s.gcr.io": "gcr",
		"us.gcr.io": "gcr"
	}
}

The projects pom.xml has Jib

            <plugin>
                <groupId>com.google.cloud.tools</groupId>
                <artifactId>jib-maven-plugin</artifactId>
                <version>1.0.0</version>
                <configuration>
                    <from>
                        <image>gcr.io/distroless/java</image>
                    </from>
                    <to>
                        <image>nexus.mycompany.com/my-service</image>
                        <credHelper>wincred</credHelper>
                        <tags>
                            <tag>latest</tag>
                        </tags>
                    </to>
                </configuration>
            </plugin>

I've logged into Nexus

$ docker login nexus.mycompany.com
Username: me
Password:
Login Succeeded

Skaffold build is successful until this final line

skaffold build -v debug
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  16.690 s
[INFO] Finished at: 2019-02-16T21:04:33Z
[INFO] ------------------------------------------------------------------------
FATA[0019] build failed: building [nexus.mycompany.com/my-service]: build artifact: getting digest: UNAUTHORIZED: "access to the requested resource is not authorized"

I can see the credentials for Nexus stored in Windows Credentials Manager

dkirrane · 2019-02-19T11:49:05Z

Hi all, looks like this needs to /reopen

I've found that Skaffold doesn't work with wincred docker-credential-helper. However it does work with gcr credhelper so that's fine

When using wincred the error: getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\"

Workaround:

docker logout nexus.mycompany.com
remove wincred from ~/.docker/config.json
docker login nexus.mycompany.com --username x --password y
skaffold run now works

The username & password get stored in ~/.docker/config.json without using wincred e.g.

{
	"auths": {
		"nexus.mycompany.com": {
			"auth": "EncodedUsernamePasswordHere"
		}
	},
	"HttpHeaders": {
		"User-Agent": "Docker-Client/18.09.0 (windows)"
	},
	"credHelpers": {
		"asia.gcr.io": "gcr",
		"eu.gcr.io": "gcr",
		"gcr.io": "gcr",
		"staging-k8s.gcr.io": "gcr",
		"us.gcr.io": "gcr"
	}
}

balopat · 2019-02-19T16:09:27Z

Reopening, thank you for looking into deeper!

jonjohnsonjr · 2019-02-19T18:30:44Z

This is probably a bug with how we interact with wincred or the default cred helper. I don't have a windows machine, so it's hard for me to debug, but I would expect it to work. We create a cred helper from credsStore here:
https://github.com/google/go-containerregistry/blob/bada66e31e55b96029f4e456f8eb107f58319629/pkg/authn/keychain.go#L128-L131

Which then calls this:
https://github.com/google/go-containerregistry/blob/bada66e31e55b96029f4e456f8eb107f58319629/pkg/authn/helper.go#L62-L102

So something weird is happening there.

balopat · 2019-09-03T22:21:43Z

I will start to look into windows bugs including this, as we are getting a windows machine now...

dgageot · 2019-11-07T14:44:14Z

I'm going to close this issue because it seems to work ok now. Feel free to reopen if you still see the issue.

dgageot added kind/bug Something isn't working build/jib labels Oct 15, 2018

dgageot closed this as completed Jan 19, 2019

balopat reopened this Feb 19, 2019

nkubala added the needs-reproduction needs reproduction from the maintainers to validate the issue is truly a skaffold bug label Mar 26, 2019

balopat mentioned this issue Mar 27, 2019

Fail building with Azure Container Registry #1649

Closed

balopat added the help wanted We would love to have this done, but don't have the bandwidth, need help from contributors label Jul 2, 2019

nkubala added the priority/p2 May take a couple of releases label Aug 13, 2019

balopat added the area/build label Aug 20, 2019

balopat added the platform/windows label Sep 3, 2019

nkubala assigned balopat and nkubala Sep 17, 2019

dgageot closed this as completed Nov 7, 2019

briandealwis mentioned this issue Jan 20, 2020

Skaffold-Jib should pass back the generated image digest #3540

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\"" #1160

getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\"" #1160

dkirrane commented Oct 15, 2018

dgageot commented Oct 15, 2018 •

edited

Loading

briandealwis commented Oct 15, 2018 •

edited

Loading

loosebazooka commented Oct 15, 2018

coollog commented Nov 9, 2018

dkirrane commented Nov 14, 2018 •

edited

Loading

dkirrane commented Nov 14, 2018 •

edited

Loading

coollog commented Nov 19, 2018

dgageot commented Jan 19, 2019

briandealwis commented Jan 25, 2019

dkirrane commented Feb 16, 2019 •

edited

Loading

dkirrane commented Feb 19, 2019 •

edited

Loading

balopat commented Feb 19, 2019

jonjohnsonjr commented Feb 19, 2019

balopat commented Sep 3, 2019

dgageot commented Nov 7, 2019

getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\"" #1160

getting digest: UNAUTHORIZED: \"access to the requested resource is not authorized\"" #1160

Comments

dkirrane commented Oct 15, 2018

Expected behavior

Actual behavior

Information

Steps to reproduce the behavior

dgageot commented Oct 15, 2018 • edited Loading

briandealwis commented Oct 15, 2018 • edited Loading

loosebazooka commented Oct 15, 2018

coollog commented Nov 9, 2018

dkirrane commented Nov 14, 2018 • edited Loading

dkirrane commented Nov 14, 2018 • edited Loading

coollog commented Nov 19, 2018

dgageot commented Jan 19, 2019

briandealwis commented Jan 25, 2019

dkirrane commented Feb 16, 2019 • edited Loading

dkirrane commented Feb 19, 2019 • edited Loading

balopat commented Feb 19, 2019

jonjohnsonjr commented Feb 19, 2019

balopat commented Sep 3, 2019

dgageot commented Nov 7, 2019

dgageot commented Oct 15, 2018 •

edited

Loading

briandealwis commented Oct 15, 2018 •

edited

Loading

dkirrane commented Nov 14, 2018 •

edited

Loading

dkirrane commented Nov 14, 2018 •

edited

Loading

dkirrane commented Feb 16, 2019 •

edited

Loading

dkirrane commented Feb 19, 2019 •

edited

Loading