k8s:push failed with aws ecr credential helper for docker #702
Comments
|
https://www.eclipse.org/jkube/docs/kubernetes-maven-plugin#extended-authentication |
|
@missedone : Hello, do you have your AWS IAM id/secret configured in system properties, plugin configuration, or maven [0] https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html |
|
I checked Fabric8 Docker Maven Plugin and JKube implementation(our docker service code is ported from DMP) and I see DMP uses the new I'll port this to jkube to see if it resolves your issue [0] fabric8io/docker-maven-plugin#1317 |
No. I have IAM role for service account (IRSA) attached on my build pod in k8s. i assume the AWS Java SDK should be able to login with AWS_WEB_IDENTITY_TOKEN_FILE. BTW, DMP works for me, yes pls port the change i can test it. Thanks, |
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 11, 2021
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 11, 2021
Port of fabric8io/docker-maven-plugin#1318 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
12 tasks
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 11, 2021
Port of fabric8io/docker-maven-plugin#1318 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
manusa
pushed a commit
that referenced
this issue
Jun 14, 2021
Port of fabric8io/docker-maven-plugin#1318 Related to #702 Signed-off-by: Rohan Kumar <[email protected]>
|
@missedone : #718 got merged to master. Would it be possible for you to test this with 1.4.0-SNAPSHOT version of master. You would need to build jkube or use jitpack |
|
@rohanKanojia , could you publish the snapshot to somewhere so i can consume in our CI jobs. thx |
|
Umm, I didn't realize you were using it in your pipelines. Right now we don't publish snapshots anywhere and suggest using jitpack for trying out snapshot builds. I think you'll need to wait for our next release in order to test. |
|
Jitpack should be usable in your pipelines (unless you have it forbidden as a repository source). <repositories>
<repository>
<id>jitpack.io</id>
<url>https://jitpack.io</url>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>jitpack.io</id>
<url>https://jitpack.io</url>
</pluginRepository>
</pluginRepositories>
<build>
<plugins>
<plugin>
<groupId>com.github.eclipse.jkube</groupId>
<artifactId>kubernetes-maven-plugin</artifactId>
<version>master-SNAPSHOT</version>
</plugin>
</plugins>
</build> |
|
hi @rohanKanojia |
|
Hello, I thought your issue was regarding pushing image rather than building image. Would it be possible for you to share a reproducer project so that I can reproduce? |
|
hi @rohanKanojia AWS ECR credential helper for docker get the auth info from context, in my case it's IRSA (IamRole for Service Account), which means we should use WebIdentityTokenFile, see more context aws/aws-sdk-java#2136 |
|
also look at https://github.com/eclipse/jkube/blob/969025bf6bd21f22ec02ef4a72174ae49aaad5bb/jkube-kit/build/service/docker/src/main/java/org/eclipse/jkube/kit/build/service/docker/auth/AuthConfigFactory.java#L227-L239 |
|
oh, thanks a lot for pointing out. I'm seeing that there are some implementation differences in dmp and jkube in AuthConfigFactory. Looks like we need to port two more PRs fabric8io/docker-maven-plugin#1310 |
|
fabric8io/docker-maven-plugin#1311 is more relavant to the issue, pls let me know once it's available in master-SNAPSHOT, i will test out |
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 18, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
12 tasks
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 18, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 18, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 18, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 18, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
rohanKanojia
added a commit
to rohanKanojia/jkube
that referenced
this issue
Jun 22, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to eclipse-jkube#702 Signed-off-by: Rohan Kumar <[email protected]>
manusa
pushed a commit
that referenced
this issue
Jun 23, 2021
Add support in AuthConfigFactory to retrieve credentials from different mechanisms for AWS. Port of fabric8io/docker-maven-plugin#1311 Port of fabric8io/docker-maven-plugin#1310 Related to #702 Signed-off-by: Rohan Kumar <[email protected]>
|
Hi @missedone |
|
@manusa , yes it works now, thank you and @rohanKanojia below is my plugin configuration snippet <plugin>
<groupId>com.github.eclipse.jkube</groupId>
<artifactId>kubernetes-maven-plugin</artifactId>
<version>master-SNAPSHOT</version>
<configuration>
<verbose>true</verbose>
<registry>############.dkr.ecr.us-west-2.amazonaws.com</registry>
<images>
<image>
<name>my-service:${docker.image.tag}</name>
<build>
....
</build>
</image>
</images>
</configuration>
<dependencies>
<!-- aws sdk is used for aws ecr login -->
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-core</artifactId>
<version>1.11.1034</version>
</dependency>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-sts</artifactId>
<version>1.11.1034</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.11.4</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.11.4</version>
</dependency>
</dependencies>
</plugin> |
|
@manusa , i think better to update the doc with mentioning the above plugin dependencies for ECR login |
|
hmm, i have to reopen this issue, since i got error below when pull the base image obviously i want it pull from dockerhub but the plugin was trying to pull from my private ECR. |
|
well looks like i have to set the image registry of below works for me <plugin>
<groupId>com.github.eclipse.jkube</groupId>
<artifactId>kubernetes-maven-plugin</artifactId>
<version>master-SNAPSHOT</version>
<configuration>
<verbose>true</verbose>
<images>
<image>
<registry>############.dkr.ecr.us-west-2.amazonaws.com</registry>
<name>my-service:${docker.image.tag}</name>
<build>
...
</build>
</image>
</images>
</configuration>
<dependencies>
<!-- aws sdk is used for aws ecr login -->
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-core</artifactId>
<version>1.11.1034</version>
</dependency>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-sts</artifactId>
<version>1.11.1034</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.11.4</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.11.4</version>
</dependency>
</dependencies>
</plugin> |
|
In the global configuration there are I assume that your problem is that the global |
|
I think the global registry shouldn't impact what being defined in the Dockerfile, Ex. if the Dockerfile use base image i agree it's separate issue, since it works for me if put the registry at image element #702 (comment) i'm going to close this ticket now, thank you guys again. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
I have aws ecr credential helper for docker install on Ubuntu 20.04
the setup works well, if i use native docker cli to pull or push.
however, when i tried with jkube maven plugin 1.1.0, 1.2.0. or 1.3.0, got the same error below
Error: k8s: nullmy project is a spring boot app, the k8s:build works, and below is the kubernetes-maven-plugin config in pom.xml
Info
mvn -v) : 3.6.3 with Java 11Kubernetes / Red Hat OpenShift setup and version :
If it's a bug, how to reproduce :
If it's a feature request, what is your use case :
Sample Reproducer Project : [GitHub Clone URL]
The text was updated successfully, but these errors were encountered: