-
Bug
-
Resolution: Unresolved
-
Minor
-
None
Following instructions on https://github.com/openshift/jenkins-client-plugin#moving-images-cluster-to-cluster, I am unable to promote the image between two openshift clusters as it throws an authentication issue.
Adding a sleep after the two withDockerRegistry calls, I can see that two folders are created under the <jobname>@TMP directory (unique names for each) with a config.json under each of them - these contain the authentication details to the respective registries.
Docker-commons-plugin version: 1.15
Docker plugin version: 1.1.7
Openshift Client plugin version: 1.0.31 (openshift client and docker registry version: 3.7.119)
Jenkins: 2.176.2
[Pipeline] { (Copy from source to dest)
[Pipeline] script
[Pipeline] {
[Pipeline] withDockerRegistry
$ docker login -u openshift/skopeo -p ******** https://docker-registry-default.<redacted>
Login Succeeded
[Pipeline] {
[Pipeline] withDockerRegistry
$ docker login -u ci-cd/jenkins -p ******** https://docker-registry.<redacted>
Login Succeeded
[Pipeline] {
[Pipeline] sh
+ /bin/oc image mirror --insecure=true docker-registry.<redacted>/appversion/appversion:latest docker-registry-default.<redacted>/appversion/appversion:latest
error: unable to retrieve source image docker-registry.<redacted>/appversion/appversion by tag: unauthorized: authentication required
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // script
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: script returned exit code 1
Finished: FAILURE
[JENKINS-58837] withDockerRegistry on multiple clusters
Paul Clark
created issue -
Paul Clark
made changes -
| Description |
Original:
Following instructions on [https://github.com/openshift/jenkins-client-plugin#moving-images-cluster-to-cluster], I am unable to promote the image between two openshift clusters as it throws an authentication issue. Adding a sleep after the two withDockerRegistry calls, I can see that two folders are created under the <jobname>@TMP directory (unique names for each) with a config.json under each of them - these contain the authentication details to the respective registries. Docker-commons-plugin version: 1.15 Docker plugin version: 1.1.7 Openshift Client plugin version: 1.0.31 (openshift client and docker registry version: 3.7.119) Jenkins: 2.176.2 [Pipeline] { (Copy from source to dest)[Pipeline] script[Pipeline] {[Pipeline] withDockerRegistry$ docker login -u openshift/skopeo -p ******** [https://docker-registry-default.<redacted>|https://docker-registry-default.infra.ocp-reg.hbs.net.au/]Login Succeeded[Pipeline] {[Pipeline] withDockerRegistry$ docker login -u ci-cd/jenkins -p ******** [https://docker-registry.<redacted>|https://docker-registry.apps.ocp-tst.hbs.net.au/]Login Succeeded[Pipeline] {[Pipeline] sh+ /bin/oc image mirror --insecure=true docker-registry.<redacted>/appversion/appversion:latest docker-registry-default.<redacted>/appversion/appversion:latest error: unable to retrieve source image docker-registry.<redacted>/appversion/appversion by tag: unauthorized: authentication required[Pipeline] }[Pipeline] // withDockerRegistry[Pipeline] }[Pipeline] // withDockerRegistry[Pipeline] }[Pipeline] // script[Pipeline] }[Pipeline] // stage[Pipeline] }[Pipeline] // withEnv[Pipeline] }[Pipeline] // node |
New:
Following instructions on [https://github.com/openshift/jenkins-client-plugin#moving-images-cluster-to-cluster], I am unable to promote the image between two openshift clusters as it throws an authentication issue. Adding a sleep after the two withDockerRegistry calls, I can see that two folders are created under the <jobname>@TMP directory (unique names for each) with a config.json under each of them - these contain the authentication details to the respective registries. Docker-commons-plugin version: 1.15 Docker plugin version: 1.1.7 Openshift Client plugin version: 1.0.31 (openshift client and docker registry version: 3.7.119) Jenkins: 2.176.2 {code:java} [Pipeline] { (Copy from source to dest) [Pipeline] script [Pipeline] { [Pipeline] withDockerRegistry $ docker login -u openshift/skopeo -p ******** https://docker-registry-default.<redacted> Login Succeeded [Pipeline] { [Pipeline] withDockerRegistry $ docker login -u ci-cd/jenkins -p ******** https://docker-registry.<redacted> Login Succeeded [Pipeline] { [Pipeline] sh + /bin/oc image mirror --insecure=true docker-registry.<redacted>/appversion/appversion:latest docker-registry-default.<redacted>/appversion/appversion:latest error: unable to retrieve source image docker-registry.<redacted>/appversion/appversion by tag: unauthorized: authentication required [Pipeline] } [Pipeline] // withDockerRegistry [Pipeline] } [Pipeline] // withDockerRegistry [Pipeline] } [Pipeline] // script [Pipeline] } [Pipeline] // stage [Pipeline] } [Pipeline] // withEnv [Pipeline] } [Pipeline] // node [Pipeline] End of Pipeline ERROR: script returned exit code 1 Finished: FAILURE {code} |
Paul Clark
added a comment - Workaround:
Command line docket logins, do the image mirror and then Docker logouts
Post pipeline always to empty out the docker config.json.
Not the best as any other pipelines running at the same time for cluster promotions on that node would have issues
Paul Clark
added a comment - Workaround:
Command line docket logins, do the image mirror and then Docker logouts
Post pipeline always to empty out the docker config.json.
Not the best as any other pipelines running at the same time for cluster promotions on that node would have issues 
pjdarton
made changes -
| Component/s | New: docker-workflow-plugin [ 20625 ] | |
| Component/s | Original: docker-plugin [ 18724 ] |
pjdarton
added a comment - FYI withDockerRegistry etc come from the docker-workflow-plugin, not the docker-plugin. I've updated the components field accordingly.
pjdarton
added a comment - FYI withDockerRegistry etc come from the docker-workflow-plugin, not the docker-plugin. I've updated the components field accordingly. There is a workaround for this, to tell jenkins to use older, deprecated method of
So I starting jenkins with:
JAVA_OPTS=-Dorg.jenkinsci.plugins.docker.commons.credentials.DockerRegistryToken.USE_CUSTOM_LOGIN=true
Downside of this approach is that all jenkins jobs share .docker/config.json and there is a problem with parallel job executions on same agent.., but I currently do not see better workaround as oc command does not seems to support different location of creds file and even if it does, not sure how to point to that tmp location.
Also openshift plugin is not supporting oc image mirror
Ladislav Toldy
added a comment - - edited There is a workaround for this, to tell jenkins to use older, deprecated method of
https://github.com/jenkinsci/docker-commons-plugin/blob/master/src/main/java/org/jenkinsci/plugins/docker/commons/credentials/DockerRegistryToken.java#L99
So I starting jenkins with:
JAVA_OPTS=-Dorg.jenkinsci.plugins.docker.commons.credentials.DockerRegistryToken.USE_CUSTOM_LOGIN=true
Downside of this approach is that all jenkins jobs share .docker/config.json and there is a problem with parallel job executions on same agent.., but I currently do not see better workaround as oc command does not seems to support different location of creds file and even if it does, not sure how to point to that tmp location.
Also openshift plugin is not supporting oc image mirror clarkster good suggestion! You can save yourself some cleanup by doing the first with the plugin and additional ones manually. You benefit from the cleanup functionality.
withDockerRegistry('registry1', ..) { sh 'docker login registry2 ..' }
Ryan Desmond
added a comment - - edited clarkster good suggestion! You can save yourself some cleanup by doing the first with the plugin and additional ones manually. You benefit from the cleanup functionality.
withDockerRegistry( 'registry1' , ..) {
sh 'docker login registry2 ..'
}
| Assignee | Original: Nicolas De Loof [ ndeloof ] |
Today I faced exactly the same bug. At least it's not a problem of Windows agent that I use. Did you find some workaround (except traditional pull + push)?