The following GitLab CI pipeline pushes images to a private Harbor Registry:
docker_build_dev:
tags:
- oasys
image:
name: gcr.io/kaniko-project/executor:v1.12.1-debug
entrypoint: [""]
only:
- harbor
stage: docker
variables:
DEV_TAG: dev-latest
HARBOR_HOST: "https://harbor.mycompany.com"
HARBOR_PROJECT: "oasys"
HARBOR_ROBOT_USER: "robot$$myproject+abcd"
HARBOR_ROBOT_PASSWORD: "Kusixxxxxxxxxxxxxxxxxxxxxx"
before_script:
- echo "Docker build"
- echo "${HARBOR_HOST}"
- echo "$HARBOR_HOST"
- echo "${HARBOR_ROBOT_USER}"
- echo "${HARBOR_ROBOT_PASSWORD}"
extends: .create_dockerfile
after_script:
- mkdir -p /kaniko/.docker
- echo "{\"auths\":{\"${HARBOR_HOST}\":{\"auth\":\"$(printf "%s:%s" "${HARBOR_ROBOT_USER}" "${HARBOR_ROBOT_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
- >-
/kaniko/executor
--context "${CI_PROJECT_DIR}"
--dockerfile "${CI_PROJECT_DIR}/Dockerfile"
--destination "${HARBOR_HOST}/${HARBOR_PROJECT}/${CI_PROJECT_NAME}:{$DEV_TAG}"
- echo "${CI_REGISTRY_IMAGE}:{$DEV_TAG}"
When this pipeline executes it throws an error as in the sample pipeline log below:
dockerfile created
/builds/thxxxxx/0/oasys/services/myservice/src
dockerfile successfully generated. Proceeding with kaniko push
starting kaniko push
dockerfile successfully copied
Running after_script
00:01
Running after script...
$ mkdir -p /kaniko/.docker
$ echo "{\"auths\":{\"${HARBOR_HOST}\":{\"auth\":\"$(printf "%s:%s" "${HARBOR_ROBOT_USER}" "${HARBOR_ROBOT_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
$ /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile" --destination "${HARBOR_HOST}/${HARBOR_PROJECT}/${CI_PROJECT_NAME}:$DEV_TAG"
error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "https://harbor.mycompany.com/oasys/myservice:dev-latest": creating push check transport for https: failed: Get "https://https/v2/": Forbidden
Cleaning up file based variables
00:00
Job succeeded
The Harbor robot account that I am using for this pipeline already has "Push" permissions configured.
When I attempt a "Docker push" from the local shell to the same Harbor registry it works successfully:
docker tag myservice:dev-latest https://harbor.mycompany.com/oasys/myservice:dev-latest
docker push https://harbor.mycompany.com/oasys/jonhdoe/myservice:dev-latest
However, I have observed that once I omit the "docker tag" command for a first-time push the image will also fail to be pushed to Harbor.
NB: The Harbor registry and GitLab CI server are running on the same network and they both trust each other (same CA).
What am I missing?