kaniko icon indicating copy to clipboard operation
kaniko copied to clipboard

ecr push with Ignore Tag Immutability errors not working anymore

Open rohit-tandon opened this issue 7 months ago • 0 comments

Actual behavior kaniko image push with --push-ignore-immutable-tag-errors isn't working because it depends upon error message from AWS and aws has changed the message.

Kaniko logic to catch tag immutability error depends upon part error message returned by the aws/ecr, it expects aws error message to contain cannot be overwritten because the repository is immutable, but at some point aws has updated message to cannot be overwritten because the tag is immutable, notice the change from repository to tag. https://github.com/GoogleContainerTools/kaniko/blob/v1.23.2/pkg/executor/push.go#L301 https://github.com/GoogleContainerTools/kaniko/blob/v1.23.2/pkg/executor/push.go#L71

Preferable this logic can be changed to use "ImageTagAlreadyExistsException" thrown by aws-cli instead of depending upon error message. https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html

Expected behaviour push-ignore-immutable-tag-errors should catch and ignore the error. Preferably

To Reproduce Steps to reproduce the behavior:

  1. Set an AWS ECR repo as immutable
  2. push an image to repo using kaniko push /kaniko/executor --dockerfile ./Dockerfile --context . --cleanup --push-ignore-immutable-tag-errors --destination
  3. push the same image again
  4. error pushing image: failed to push to destination ecr-destination:tag: TAG_INVALID: The image tag already exists in the repository and cannot be overwritten because the tag is immutable.

Additional Information

Triage Notes for the Maintainers

Description Yes/No
Please check if this a new feature you are proposing
  • - [ ]
Please check if the build works in docker but not in kaniko
  • - [ ]
Please check if this error is seen when you use --cache flag
  • - [ ]
Please check if your dockerfile is a multistage dockerfile
  • - [ ]

rohit-tandon avatar May 12 '25 13:05 rohit-tandon