Following instructions on https://github.com/openshift/jenkins-client-plugin#moving-images-cluster-to-cluster, I am unable to promote the image between two openshift clusters as it throws an authentication issue.

      Adding a sleep after the two withDockerRegistry calls, I can see that two folders are created under the <jobname>@TMP directory (unique names for each) with a config.json under each of them - these contain the authentication details to the respective registries.

       

      Docker-commons-plugin version: 1.15

      Docker plugin version: 1.1.7

      Openshift Client plugin version: 1.0.31 (openshift client and docker registry version: 3.7.119)

      Jenkins: 2.176.2

       

      [Pipeline] { (Copy from source to dest)
      [Pipeline] script
      [Pipeline] {
      [Pipeline] withDockerRegistry
      $ docker login -u openshift/skopeo -p ******** https://docker-registry-default.<redacted>
      Login Succeeded
      [Pipeline] {
      [Pipeline] withDockerRegistry
      $ docker login -u ci-cd/jenkins -p ******** https://docker-registry.<redacted>
      Login Succeeded
      [Pipeline] {
      [Pipeline] sh
      + /bin/oc image mirror --insecure=true docker-registry.<redacted>/appversion/appversion:latest docker-registry-default.<redacted>/appversion/appversion:latest
      error: unable to retrieve source image docker-registry.<redacted>/appversion/appversion by tag: unauthorized: authentication required
      [Pipeline] }
      [Pipeline] // withDockerRegistry
      [Pipeline] }
      [Pipeline] // withDockerRegistry
      [Pipeline] }
      [Pipeline] // script
      [Pipeline] }
      [Pipeline] // stage
      [Pipeline] }
      [Pipeline] // withEnv
      [Pipeline] }
      [Pipeline] // node
      [Pipeline] End of Pipeline
      ERROR: script returned exit code 1
      Finished: FAILURE
      

          [JENKINS-58837] withDockerRegistry on multiple clusters

          Sergey Gladskih added a comment - - edited

          Today I faced exactly the same bug. At least it's not a problem of Windows agent that I use. Did you find some workaround (except traditional pull + push)?

          Sergey Gladskih added a comment - - edited Today I faced exactly the same bug. At least it's not a problem of Windows agent that I use. Did you find some workaround (except traditional pull + push)?

          Paul Clark added a comment -

          Workaround:
          Command line docket logins, do the image mirror and then Docker logouts
          Post pipeline always to empty out the docker config.json.

          Not the best as any other pipelines running at the same time for cluster promotions on that node would have issues

          Paul Clark added a comment - Workaround: Command line docket logins, do the image mirror and then Docker logouts Post pipeline always to empty out the docker config.json. Not the best as any other pipelines running at the same time for cluster promotions on that node would have issues

          pjdarton added a comment -

          FYI withDockerRegistry etc come from the docker-workflow-plugin, not the docker-plugin. I've updated the components field accordingly.

          pjdarton added a comment - FYI withDockerRegistry etc come from the docker-workflow-plugin, not the docker-plugin. I've updated the components field accordingly.

          Ladislav Toldy added a comment - - edited

          There is a workaround for this, to tell jenkins to use older, deprecated method of 

          https://github.com/jenkinsci/docker-commons-plugin/blob/master/src/main/java/org/jenkinsci/plugins/docker/commons/credentials/DockerRegistryToken.java#L99

          So I starting jenkins with: 
          JAVA_OPTS=-Dorg.jenkinsci.plugins.docker.commons.credentials.DockerRegistryToken.USE_CUSTOM_LOGIN=true
          Downside of this approach is that all jenkins jobs share .docker/config.json and there is a problem with parallel job executions on same agent.., but I currently do not see better workaround as oc command does not seems to support different location of creds file and even if it does, not sure how to point to that tmp location.

          Also openshift plugin is not supporting oc image mirror

          Ladislav Toldy added a comment - - edited There is a workaround for this, to tell jenkins to use older, deprecated method of  https://github.com/jenkinsci/docker-commons-plugin/blob/master/src/main/java/org/jenkinsci/plugins/docker/commons/credentials/DockerRegistryToken.java#L99 So I starting jenkins with:  JAVA_OPTS=-Dorg.jenkinsci.plugins.docker.commons.credentials.DockerRegistryToken.USE_CUSTOM_LOGIN=true Downside of this approach is that all jenkins jobs share .docker/config.json and there is a problem with parallel job executions on same agent.., but I currently do not see better workaround as oc command does not seems to support different location of creds file and even if it does, not sure how to point to that tmp location. Also openshift plugin is not supporting oc image mirror

          Ryan Desmond added a comment - - edited

          clarkster good suggestion!  You can save yourself some cleanup by doing the first with the plugin and additional ones manually.  You benefit from the cleanup functionality.

          withDockerRegistry('registry1', ..) {
            sh 'docker login registry2 ..'
          }
          

          Ryan Desmond added a comment - - edited clarkster good suggestion!  You can save yourself some cleanup by doing the first with the plugin and additional ones manually.  You benefit from the cleanup functionality. withDockerRegistry( 'registry1' , ..) { sh 'docker login registry2 ..' }

            Unassigned Unassigned
            clarkster Paul Clark
            Votes:
            2 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated: