origin: error: build error: Failed to push image: unauthorized: authentication required

[provide a description of the issue]

oc start-build fails reporting

error: build error: Failed to push image: unauthorized: authentication required

However from the logs (–build-loglevel=5) it shows the following :

Pushing image 172.30.25.196:5000/ns/app:latest … The push refers to a repository [172.30.25.196:5000/ns/app] Preparing Preparing Waiting Waiting Waiting Waiting Waiting Image push failed Image push failed Image push failed Image push failed Layer already exists Layer already exists Layer already exists Layer already exists Layer already exists Pushing [> ] 525.3 kB/201.4 MB Pushing [> ] 1.082 MB/201.4 MB Pushing [> ] 1.639 MB/201.4 MB … Pushing [=================================================> ] 200 MB/201.4 MB Pushing [=================================================> ] 200.5 MB/201.4 MB Pushing [=================================================> ] 201.1 MB/201.4 MB Pushing [==================================================>] 201.4 MB Pushed Registry server Address: Registry server User Name: serviceaccount Registry server Email: serviceaccount@example.org Registry server Password: <<non-empty>> F0113 02:33:45.330829 1 helpers.go:115] error: build error: Failed to push image: unauthorized: authentication required error: The build ns/bapp-43 status is “Failed”

Version

[provide output of the openshift version or oc version command]

1.4.0-rc1 build from release-1.4 branch

oc v1.4.0-rc1+b4e0954 kubernetes v1.4.0+776c994 features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://master.ns.com.au:8443 openshift v1.4.0-rc1+9143f7b-65 kubernetes v1.4.0+776c994

Steps To Reproduce

Not easily reproducable as it doesn’t happen always.

If it happens, it usually self corrects after a few retries at the build.

Sometimes I try scaling the registry to 0 then back to 1 and that usualy fixes it.

Additional Information

oc adm diagnostics contains the following log entry :

   time="2017-01-13T02:33:26Z" level=error msg="error authorizing context: authorization header required" go.version=go1.7.3 http.request.host="172.30.25.196:5000" http.request.id=22715f31-27c3-4e16-97fa-17a5e293c4c0 http.request.method=GET http.request.remoteaddr="10.128.2.1:50680" http.request.uri="/v2/" http.request.useragent="docker/1.12.5 go/go1.6.4 git-commit/7392c3b kernel/3.10.0-514.2.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(go-dockerclient)" instance.id=7d410b5d-d99f-4cae-949f-4cb8d2e01c8a

About this issue

  • Original URL
  • State: closed
  • Created 7 years ago
  • Reactions: 4
  • Comments: 17 (12 by maintainers)

Most upvoted comments

Again, there’s no relevant error in the registry logs. The registry redirects docker client to some remote storage back-end. May I ask what storage back-end do you use and how do you configure it? It seems like registry produced a redirect url with for the storage back-end with bad credentials. And docker-daemon then failed to interact with the back-end.

Can you still reproduce the issue if you disable redirects in registry config or using env variable REGISTRY_STORAGE_REDIRECT_DISABLE=true [1] ?

https://docs.docker.com/registry/configuration/#redirect