jx: Anchore addon error - unauthorized: authentication required

Summary

I installed the addon with

jx create addon anchore

Not problem so far, but when I try to run the pipeline following https://jenkins.io/blog/2018/05/08/jenkins-x-anchore/ I have the error

Steps to reproduce the behavior

Jx version

NAME               VERSION
jx                 1.3.746
jenkins x platform 0.0.3193
Kubernetes cluster v1.11.5-eks-6bad6d
kubectl            v1.13.1
helm client        v2.12.1+g02a47c7
helm server        v2.12.1+g02a47c7
git                git version 2.17.2 (Apple Git-113)
Operating System   Mac OS X 10.13.6 build 17G4015

Kubernetes cluster

EKS

Jenkins logs

error: error adding image to CVE provider: failed to add image XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice:0.0.0-SNAPSHOT-PR-3-7 to anchore engine: exit status 1

Actual behavior

[service:catalog] 2019-01-16 21:12:50+0000 [_GenericHTTPChannelProtocol,2,192.168.41.231] [PoolThread-twisted.internet.reactor-0] [anchore_engine.auth.skopeo_wrapper/get_image_manifest_skopeo()] [ERROR] command failed with exception - Error encountered in skopeo operation. cmd=/bin/sh -c skopeo inspect --raw --tls-verify=false  docker://XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice:0.0.0-SNAPSHOT-PR-3-7, rc=1, stdout=None, stderr=time="2019-01-16T21:12:50Z" level=fatal msg="Error reading manifest 0.0.0-SNAPSHOT-PR-3-7 in XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice: unauthorized: authentication required"
[service:catalog] 2019-01-16 21:12:50+0000 [_GenericHTTPChannelProtocol,2,192.168.41.231] [PoolThread-twisted.internet.reactor-0] [anchore_engine.auth.skopeo_wrapper/get_image_manifest_skopeo()] [WARN] CMD failed - exception: Error encountered in skopeo operation. cmd=/bin/sh -c skopeo inspect --raw --tls-verify=false  docker://XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice:0.0.0-SNAPSHOT-PR-3-7, rc=1, stdout=None, stderr=time="2019-01-16T21:12:50Z" level=fatal msg="Error reading manifest 0.0.0-SNAPSHOT-PR-3-7 in XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice: unauthorized: authentication required"
[service:catalog] 2019-01-16 21:12:50+0000 [_GenericHTTPChannelProtocol,2,192.168.41.231] [PoolThread-twisted.internet.reactor-0] [anchore_engine.auth.docker_registry/get_image_manifest()] [ERROR] could not fetch manifest/digest: Error encountered in skopeo operation. cmd=/bin/sh -c skopeo inspect --raw --tls-verify=false  docker://XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice:0.0.0-SNAPSHOT-PR-3-7, rc=1, stdout=None, stderr=time="2019-01-16T21:12:50Z" level=fatal msg="Error reading manifest 0.0.0-SNAPSHOT-PR-3-7 in XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice: unauthorized: authentication required"
[service:catalog] 2019-01-16 21:12:50+0000 [_GenericHTTPChannelProtocol,2,192.168.41.231] [PoolThread-twisted.internet.reactor-0] [anchore_engine.auth.docker_registry/get_image_manifest()] [ERROR] could not get manifest/digest for image (XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice:0.0.0-SNAPSHOT-PR-3-7) from registry (https://XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com) - error: Error encountered in skopeo operation. cmd=/bin/sh -c skopeo inspect --raw --tls-verify=false  docker://XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice:0.0.0-SNAPSHOT-PR-3-7, rc=1, stdout=None, stderr=time="2019-01-16T21:12:50Z" level=fatal msg="Error reading manifest 0.0.0-SNAPSHOT-PR-3-7 in XXXXXXXXXXXX.dkr.ecr.us-XXXXXXXXXXX.amazonaws.com/efermin-jenkins/microservice: unauthorized: authentication required"

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 15 (10 by maintainers)

Most upvoted comments

This seems to be because build pipelines are running

- sh: jx step post build --image $DOCKER_REGISTRY/$ORG/$APP_NAME:\$(cat VERSION)

but $ORG is not set, resulting in a partial path thus: gcr.io//test273:0.0.1

For GKE, $ORG should be the GCP ProjectID.