Pull registry is not getting authenticated

[balbusm]

Describe the bug

<sever> authentication in settings.xml doesn't work for pullregistry.
Also using docker login is not respected with pullregistry (settings.xml without server section).

I have two separate docker registries. One for pull (dockerhub proxy) and one for push.
Case 1. jkube doesn't respect settings.xml configuration

settings.xml

<settings>
  <servers>
    <server>
      <id>my.proxy</id>
      <username>user</username>
      <password>pass</password>
    </server>
  </servers>
</settings>

Dockerfile

FROM my.proxy/openjdk:17
# rest of the file

I noticed that everything works as expected when I set server id to docker.io
Case 2. After logging via docker login to my.proxy I'm getting unauthorized exception.

Eclipse JKube version

1.10.0

Component

Kubernetes Maven Plugin

Apache Maven version

3.8.1

Gradle version

No response

Steps to reproduce

1. Set settings.xml

<settings>
  <servers>
    <server>
      <id>my.proxy</id>
      <username>user</username>
      <password>pass</password>
    </server>
  </servers>
</settings>

2. Set docker file
   Dockerfile

FROM my.proxy/openjdk:17

3. Set pull registry in pom:

 <plugin>
        <groupId>org.eclipse.jkube</groupId>
        <artifactId>kubernetes-maven-plugin</artifactId>
        <version>1.10.1</version>
        <configuration>
          <pullregistry>my.proxy</pullregistry>
        </configuration>

Expected behavior

Image is being downloaded from registry.

Runtime

Kubernetes (vanilla)

Kubernetes API Server version

other (please specify in additional context)

Environment

macOS

Eclipse JKube Logs

Error while trying to build the image: Unable to pull 'my.proxy/openjdk:17' : {"message":"Head \"https://my.proxy/v2/openjdk/manifests/17\": unknown: Authentication is required"} (Internal Server Error: 500) -> [Help 1]

Sample Reproducer Project

No response

Additional context

No response

[rohanKanojia]

@balbusm : Hi, Did you provide Docker Build arg mvn k8s:build -Ddocker.buildArg.https_proxy=my.proxy (It's for setting container proxy)?

[rohanKanojia]

@balbusm : Sorry, I have another question. In your settings.xml configuration, is the username password for your proxy authentication or for your DockerHub authentication?

Dockerfile
FROM my.proxy/openjdk:17

Why do you have proxy URL in image name?

[balbusm]

-Djkube.docker.pull.username/-Djkube.docker.pull.password works for me but according to documentation settings.xml or docker login should also work, but it doesn't.
I rather meant docker registry mirror, which adds registry name before image name.

[rohanKanojia]

Does it work if you set the server id to index.docker.io or docker.io in settings.xml?

[balbusm]

Yes, it works but it's not obvious and not consistent when you compare it to push config.

[rohanKanojia]

not consistent when you compare it to push config.

@balbusm : Umm, I would appreciate it if you could elaborate your point a little. By push config, are you referring to config in settings.xml or something else.

[rohanKanojia]

I tried configuring my docker daemon to use a local squid proxy and tried building from a private base image from dockerhub but it seems to be working for me. Is proxy using authentication in your case?

While doing docker login into my.proxy, did you specify https://my.proxy or just my.proxy? Just wondering whether this could be a misconfiguration issue.

[balbusm]

Let's simplify a scenario.
I have one custom repository to pull and push images.
Push config works as one would expect:

• it's possible to push image my.repo/my-image to registry after docker login my.repo is executed
• OR in settings.xml one needs to create server with id my.repo and push image my.repo/my-image

<settings>
  <servers>
    <server>
      <id>my.repo</id>
      <username>user</username>
      <password>pass</password>
    </server>
  </servers>
</settings>

In both cases push works. So I would expect if I try to pull image during a docker build above cases would work.
However:
If I try to build docker file with FROM my.repo/my-image jkube is not able to pull image.
I have to add second entry to the settings.xml:

<settings>
  <servers>
    <server>
      <id>my.repo</id> # this works only for push to my.repo
      <username>user</username>
      <password>pass</password>
    </server>
    <server>
      <id>docker.io</id> # passing here again same credentials to my.repo docker registry for pull command, 
      <username>user</username>
      <password>pass</password>
    </server>
  </servers>
</settings>

I login with docker login my.repo no https://my.repo.

[rohanKanojia]

@balbusm : Thanks a lot for your detailed explanation. I was trying to reproduce your issue by pulling a private dockerhub image as a base image and pushing it to the same dockerhub username; I had provided credentials in my settings.xml. In this case, both push and pull and working.

Let me try to reproduce your issue by setting up a local registry.

[balbusm]

The thing is you need a prefix, dockerhub registry doesn't have a prefix.