kaniko: Error on pushing image to GCR

Same here. Using v1.6.0 instead of latest solved the problem for me

Same issue here 😕 Workaround worked thanks PS : lost several hours checking and checking the roles on my service account ^^

Same, downgraded to 1.6.0 - fixed issue for me =(

Thanks fix is the way! https://github.com/GoogleContainerTools/kaniko/pull/1794

@corveen and anyone who’s struggling with this regression that’s been introduced and left unsolved 3 days ago (yes, unbelievable) along with another regression in gcloud CLI preventing AppEngine deploys that has been introduced on the same day in SDK 361.0.0 and has not been addressed to this day either, here’s what we did:

1. Add cloudbuild.yml (see below) to the root of your project

   # cloudbuild.yml
   
   steps:
     # TODO: revert to :latest tag once the following issue is closed:
     # https://github.com/GoogleContainerTools/kaniko/issues/1786
     - name: 'gcr.io/kaniko-project/executor:v1.6.0'
       id: 'Build and push container image'
       args:
         [
           '--destination=${_IMAGE}',
           '--cache=true',
           '--cache-ttl=6h'
         ]
   
   timeout: 1800s
   
   

2. Rewrite your deployment script as follows:

   IMAGE=us.gcr.io/your-project-id/your-image:your-tag
   - gcloud builds submit --tag $IMAGE
   + gcloud builds submit --substitutions _IMAGE=$IMAGE
   

3. Pin gcloud SDK to the version 360.0.0 for the time being

This is the equivalent of using gcloud builds submit --tag and gives you full control over the version of Kaniko and other parameters.

Relevant documentation that helped us solve this issue:

• https://cloud.google.com/build/docs/configuring-builds/substitute-variable-values

I can’t reproduce this issue anymore. We are using v1.9.2 (and testing v1.12), no issue so far.

In our case, this was a configuration issue. We are using GCR auth via workload identity. Till v1.6 we had to provide a Docker config file (/kaniko/.docker/config.json), like this one:

{
  "credHelpers": {
    "eu.gcr.io": "gcr",
    "gcr.io": "gcr"
  }
}

Since at least v1.8 (maybe even v1.7) you don’t need, actually you cannot have this Docker config file anymore. If this file is present, Kaniko v1.8 or newer fails with an auth error as reported in this issue. And vice versa, v1.6 does not work without the config file above.

If you are using the newest version of Kaniko with GCR and workload identities, omit the Docker config file. Keeping an empty one {} also works.

Also tested v1.8.0 and v1.8.1, same issue. Reverted back to v1.6.0, now it works 😕

Same issue here, using Kaniko for test environments, all build pipelines were broken. Temporarily fixed with rollback to version 1.6.0.

Still an issue when using 1.9.1. Used @nicolas-goudry’s suggestion which works.

https://github.com/GoogleContainerTools/kaniko/issues/1791#issuecomment-948393053

Same issue here. A workaround to use 1.7.0 with GCR using a service account is to use the .docker/config.json method providing following credentials:

$ mkdir -p /kaniko/.docker
$ echo "{\"auths\":{\"gcr.io\":{\"auth\":\"$(echo -n _json_key:$(cat service-account-key.json) | base64 | tr -d "\n")\"}}}" > /kaniko/.docker/config.json

Same issue here. A workaround to use 1.7.0 with GCR using a service account is to use the .docker/config.json method providing following credentials:

$ mkdir -p /kaniko/.docker
$ echo "{\"auths\":{\"gcr.io\":{\"auth\":\"$(echo -n _json_key:$(cat service-account-key.json) | base64 | tr -d "\n")\"}}}" > /kaniko/.docker/config.json

Having this issue too. Had to tie down the version v1.6.0