kaniko
kaniko copied to clipboard
GoogleContainerTools
ACR authentication
I am trying to push my image into Azure Container Registry. I am creating config.json like this:
cat << EOF > /kaniko/.docker/config.json
{
"auths": {
"$(ACR)": {
"username":"$(username)",
"password":"$(password)"
}
}
}
EOF
However I am getting error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "ACR.azurecr.io/example-project:latest": creating push check transport for ACR.azurecr.io failed: GET https://ACR.azurecr.io/oauth2/token?scope=repository%3Aexample-project%3Apush%2Cpull&service=ACR.azurecr.io: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.
Also tried this way:
creds="$(echo "$(username):$(password)" | base64)"
cat << EOF > /kaniko/.docker/config.json
{
"auths": {
"$(ACR)": {
"auth":"${creds}"
}
}
}
EOF
and
token="$(az acr login --name $(ACR) --expose-token | jq -r '.accessToken')"
cat << EOF > /kaniko/.docker/config.json
{
"auths": {
"$(ACR)": {
"identityToken":"${token}"
}
}
}
EOF
with same error...
Credentials are for Service principal who has Contributor role for ACR.
When I use az login --service-principal .. and az acr login ... on my local machine with the same credentials I get no error....
I have no idea what else should I try..
Destination parameter is as follows: --destination $(ACR)/$(app-name):latest
Kaniko image: latest
Running on: Ubuntu18.04 container
No, we switched to completely different solution, nonetheless, it looks like this approach is simply not supported by Kaniko.
You have to set three environment variables:
AZURE_CLIENT_ID
AZURE_CLIENT_SECRET
AZURE_TENANT_ID
And do this:
mkdir -p /kaniko/.docker
echo "{\"credHelpers\":{\"somevalue.azurecr.io\":\"acr-env\"}}" > /kaniko/.docker/config.json
This is an old post, but anyways. I was just wondering, whether it is possible to do this without a service principal, but instead using a managed identity? Thanks!
