kaniko v1.7.0 fails to clone private git repositories when specifying a specific branch

[pnbecker]

Actual behavior
I use kaniko to build images from Dockerfiles hold in a private git repository. I need to authenticate to access them. Furthermore I would like to be able to specify the branch used by adding #refs/heads/<branch-name> to the context parameter. This works well with kaniko in version 1.6.0, it fails in version 1.7.0.
If you do not specify the branch with #refs/heads/<branch-name> or do use a public repository without authentication, the error does not appear.

Expected behavior
It should be possible to build images from specify specific branches of private git repositories.

To Reproduce
Steps to reproduce the behavior:

1. Create a private git repository, add a Dockerfile into it, and create a personal access token.
2. Run: docker run -it --rm --entrypoint "" gcr.io/kaniko-project/executor:v1.7.0-debug sh -c 'GIT_PULL_METHOD=https GIT_USERNAME=<your-name> GIT_PASSWORD=<your access token> /kaniko/executor --context "git://<git-repo-url>/<git-repo-path>#refs/heads/<branch name>" --context-sub-path "postgres" --no-push --verbosity debug'
   This will clone the git repository and then still fail complaining about authentication:

DEBU[0000] Getting source context from git://<my-repo-url>/<my-repo-path>#refs/heads/master 
DEBU[0000] Getting source from reference                
Enumerating objects: 273, done.
Counting objects: 100% (62/62), done.
Compressing objects: 100% (45/45), done.
Total 273 (delta 26), reused 48 (delta 16), pack-reused 211
Error: error resolving source context: authentication required
Usage:
  executor [flags]
  executor [command]
  ...

3. Run: docker run -it --rm --entrypoint "" gcr.io/kaniko-project/executor:v1.6.0-debug sh -c 'GIT_PULL_METHOD=https GIT_USERNAME=<your-name> GIT_PASSWORD=<your access token> /kaniko/executor --context "git://<git-repo-url>/<git-repo-path>#refs/heads/<branch name>" --context-sub-path "postgres" --no-push --verbosity debug'
   This runs like a charme.

Additional Information

• Dockerfile
  You can use and Dockerfile FROM postgres is a good example

• Build Context

• Kaniko Image (fully qualified with digest)

  • v1.7.0-debug: f39fe1b68ae0
  • v1.6.0-debug: 7053f62a27a8

Triage Notes for the Maintainers

Description	Yes/No
Please check if this a new feature you are proposing
Please check if the build works in docker but not in kaniko
Please check if this error is seen when you use --cache flag
Please check if your dockerfile is a multistage dockerfile

[pnbecker]

I suppose this might have bin introduced by #1765 as it is editing pkg/buildcontext/git.go.

[sesky4]

Same, workaround:
--context=git://<git-repo-url>/<git-repo-path>#refs/heads/<branch name>#<commit-id>

[pnbecker]

@sesky4 thank you for the workaround. I thought about it before, but haven’t tested it as me and probably a lot of other people would need to change a lot of ci/cd scripts to get the commit hash everytime.

[dsever]

I have very similar issue using:
/kaniko/executor --ignore-var-run --context git://${REPO}#refs/heads/dev

And starting from 1.7.0, it goes against always master

Update: --git branch=dev should be in use, so documentation is not consistent

[gcalmettes]

Similar issue when cloning specific tags.

--context git://${REPO}#refs/tags/<tag> was working fine prior to the 1.7.0 version.

[gcalmettes]

Proposing a fix in #1823

Corresponding docker image integrating the patch: https://hub.docker.com/r/gcalmettes/kaniko/tags