Answers: <p>First generate the secrets file like this:</p>
  <pre><code>$ kubectl create secret docker-registry docker-credential
  --docker-username=xyz --docker-password=xyzpassword --docker-email=xyz@mail.com --namespace=default
  </code></pre>
  <p>Write the secret to a new yaml:</p>
  <pre><code>$ kubectl get secret docker-credential -o yaml &gt; key-alt.yaml
  </code></pre>
  <p>Edit the file so it looks like (I could have left the docker-registry out):</p>
  <pre><code>apiVersion: v1
  data:
    config.json: ewoJImF1***SIKCQl9Cgl9Cn0=
  kind: Secret
  metadata:
    name: docker-credential-3
    namespace: default
  </code></pre>
  <p>Create the secret:</p>
  <pre><code>$ kubectl apply -f key-alt.yaml
  </code></pre>
  <p>The 'red herring' was that you normally generate a docker secret using the type   'docker-registry'. It will create the secret with the key '.dockerconfig'. The Tekton task uses a different route: it requires the 'config.json' as the key of the Secret resource.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-01-05T20:20:41.320Z
Answers: 2024-01-05T20:20:41.320Z
Answers: tm1701
Body: <p>When running a pipeline with a <strong>Kaniko build task</strong>, I see the following error message:</p>
  <blockquote>
  <pre><code>E0105 13:50:28.345758      19 aws_credentials.go:77] while getting AWS credentials NoCredentialProviders: no valid providers in chain.
  Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors
  error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try
  again: checking push permission for
  &quot;docker.io/xyz/myimage&quot;: POST
  https://index.docker.io/v2/xyz/myimage/blobs/uploads/:
  UNAUTHORIZED: authentication required; [map[Action:pull Class:
  Name:xyz/myimage Type:repository] map[Action:push Class:
  Name:xyz/myimage Type:repository]]
  </code></pre>
  </blockquote>
  <p>First I created a secret by generating a Docker hub access token. The secret is created using this command:</p>
  <blockquote>
  <pre><code>k create secret docker-registry docker-credential
  --docker-username=xyz --docker-password=generated-docker-access-token --docker-email=xyz@mail.com --namespace=default
  </code></pre>
  </blockquote>
  <p>An alternative way is: getting the docker config info:</p>
  <pre><code>$ cat ~/.docker/config.json | base64 -w0 
  </code></pre>
  <p>Using this info in a secret:</p>
  <pre><code>apiVersion: v1
  kind: Secret
  metadata:
    name: docker-credential
  data:
    .dockerconfigjson: &lt;base-64-encoded-json-here&gt;
  type: kubernetes.io/dockerconfigjson
  </code></pre>
  <p>Then I installed the Tekton Kaniko task with:</p>
  <blockquote>
  <p>kubectl apply -f
  <a href="https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.6/raw" rel="nofollow noreferrer">https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.6/raw</a></p>
  </blockquote>
  <p>I run the pipeline in my local Docker Desktop Kubernets environment with a local Gitea repo, which works fine.</p>
  <p>Before showing the pipeline(run): I tried all kinds of solutions, like using the Docker hub password (iso token), use a Secret with the Docker credentials, etc. Nothing helps, yet.</p>
  <p>Finally I created and ran a pipeline(run):</p>
  <pre><code>apiVersion: tekton.dev/v1beta1
  kind: Pipeline
  metadata:
    name: buildpacks-kaniko-pipeline
  spec:
    params:
      - name: SOURCE_URL
        type: string
        description: A git repo url where the source code resides.
      - name: SOURCE_REVISION
        description: The branch, tag or SHA to checkout.
        default: &quot;&quot;
    workspaces:
      - name: source-workspace
      - name: dockerconfiginput
    tasks:
      - name: fetch-repository
        taskRef:
          name: git-clone
        workspaces:
          - name: output
            workspace: source-workspace
        params:
          - name: url
            value: &quot;$(params.SOURCE_URL)&quot;
          - name: revision
            value: &quot;$(params.SOURCE_REVISION)&quot;
          - name: subdirectory
            value: &quot;&quot;
          - name: deleteExisting
            value: &quot;true&quot;
      - name: build-kaniko
        taskRef:
          name: kaniko
        runAfter:
          - fetch-repository
        params:
          - name: IMAGE
            value: docker.io/solvedshared/kanikodemo
          - name: DOCKERFILE
            value: ./Dockerfile
          - name: CONTEXT
            value: ./
        workspaces:
          - name: source
            workspace: source-workspace
          - name: dockerconfig
            workspace: dockerconfiginput
  ---
  apiVersion: tekton.dev/v1beta1
  kind: PipelineRun
  metadata:
    name: buildpacks-kaniko-pipeline-run
  spec:
    pipelineRef:
      name: buildpacks-kaniko-pipeline
    workspaces:
      - name: source-workspace
        persistentVolumeClaim:
          claimName: source-kaniko-pvc
      - name: dockerconfiginput
        secret:
          secretName: docker-credential
    serviceAccountName: build-bot
    params:
      - name: SOURCE_URL
        value: http://gitea-gitea-http.default.svc.cluster.local:3000/gituser/kaniko-demo.git
      - name: SOURCE_REVISION
        value: master
  </code></pre>
  <p>I also tried to use another BUILD_IMAGE:</p>
  <pre><code>    - name: BUILDER_IMAGE
        value: bitnami/kaniko:1.19.2
  </code></pre>
  <p>This time I go this error message:</p>
  <blockquote>
  <pre><code>error checking push permissions -- make sure you entered the correct
  tag name, and that you are authenticated correctly, and try again:
  checking push permission for &quot;docker.io/xyz/myimage&quot;: POST
  https://index.docker.io/v2/xyz/myimage/blobs/uploads/:
  UNAUTHORIZED: authentication required; [map[Action:pull Class:
  Name:xyz/myimage Type:repository] map[Action:push Class:
  Name:xyz/myimage Type:repository]]
  </code></pre>
  </blockquote>
  
Tags: <kubernetes>
Title: Tekton Kaniko build - gives push permissions errors
UserDisplayName: tm1701
ThreadText: # Tekton Kaniko build - gives push permissions errors
  
  (Asked by: username_0 on 2024-01-05)
  
  When running a pipeline with a **Kaniko build task**, I see the following error message:
  
  > ```
  > E0105 13:50:28.345758      19 aws_credentials.go:77] while getting AWS credentials NoCredentialProviders: no valid providers in chain.
  > Deprecated.
  >   For verbose messaging see aws.Config.CredentialsChainVerboseErrors
  > error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try
  > again: checking push permission for
  > "docker.io/xyz/myimage": POST
  > https://index.docker.io/v2/xyz/myimage/blobs/uploads/:
  > UNAUTHORIZED: authentication required; [map[Action:pull Class:
  > Name:xyz/myimage Type:repository] map[Action:push Class:
  > Name:xyz/myimage Type:repository]]
  >
  > ```
  
  First I created a secret by generating a Docker hub access token. The secret is created using this command:
  
  > ```
  > k create secret docker-registry docker-credential
  > --docker-username=xyz --docker-password=generated-docker-access-token --docker-email=xyz@mail.com --namespace=default
  >
  > ```
  
  An alternative way is: getting the docker config info:
  
  ```
  $ cat ~/.docker/config.json | base64 -w0 
  
  ```
  
  Using this info in a secret:
  
  ```
  apiVersion: v1
  kind: Secret
  metadata:
    name: docker-credential
  data:
    .dockerconfigjson: <base-64-encoded-json-here>
  type: kubernetes.io/dockerconfigjson
  
  ```
  
  Then I installed the Tekton Kaniko task with:
  
  > kubectl apply -f
  > <https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.6/raw>
  
  I run the pipeline in my local Docker Desktop Kubernets environment with a local Gitea repo, which works fine.
  
  Before showing the pipeline(run): I tried all kinds of solutions, like using the Docker hub password (iso token), use a Secret with the Docker credentials, etc. Nothing helps, yet.
  
  Finally I created and ran a pipeline(run):
  
  ```
  apiVersion: tekton.dev/v1beta1
  kind: Pipeline
  metadata:
    name: buildpacks-kaniko-pipeline
  spec:
    params:
      - name: SOURCE_URL
        type: string
        description: A git repo url where the source code resides.
      - name: SOURCE_REVISION
        description: The branch, tag or SHA to checkout.
        default: ""
    workspaces:
      - name: source-workspace
      - name: dockerconfiginput
    tasks:
      - name: fetch-repository
        taskRef:
          name: git-clone
        workspaces:
          - name: output
            workspace: source-workspace
        params:
          - name: url
            value: "$(params.SOURCE_URL)"
          - name: revision
            value: "$(params.SOURCE_REVISION)"
          - name: subdirectory
            value: ""
          - name: deleteExisting
            value: "true"
      - name: build-kaniko
        taskRef:
          name: kaniko
        runAfter:
          - fetch-repository
        params:
          - name: IMAGE
            value: docker.io/solvedshared/kanikodemo
          - name: DOCKERFILE
            value: ./Dockerfile
          - name: CONTEXT
            value: ./
        workspaces:
          - name: source
            workspace: source-workspace
          - name: dockerconfig
            workspace: dockerconfiginput
  ---
  apiVersion: tekton.dev/v1beta1
  kind: PipelineRun
  metadata:
    name: buildpacks-kaniko-pipeline-run
  spec:
    pipelineRef:
      name: buildpacks-kaniko-pipeline
    workspaces:
      - name: source-workspace
        persistentVolumeClaim:
          claimName: source-kaniko-pvc
      - name: dockerconfiginput
        secret:
          secretName: docker-credential
    serviceAccountName: build-bot
    params:
      - name: SOURCE_URL
        value: http://gitea-gitea-http.default.svc.cluster.local:3000/gituser/kaniko-demo.git
      - name: SOURCE_REVISION
        value: master
  
  ```
  
  I also tried to use another BUILD\_IMAGE:
  
  ```
      - name: BUILDER_IMAGE
        value: bitnami/kaniko:1.19.2
  
  ```
  
  This time I go this error message:
  
  > ```
  > error checking push permissions -- make sure you entered the correct
  > tag name, and that you are authenticated correctly, and try again:
  > checking push permission for "docker.io/xyz/myimage": POST
  > https://index.docker.io/v2/xyz/myimage/blobs/uploads/:
  > UNAUTHORIZED: authentication required; [map[Action:pull Class:
  > Name:xyz/myimage Type:repository] map[Action:push Class:
  > Name:xyz/myimage Type:repository]]
  >
  > ```
  
  **Tags:** kubernetes
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-01-05. Score: 0
  
  First generate the secrets file like this:
  
  ```
  $ kubectl create secret docker-registry docker-credential
  --docker-username=xyz --docker-password=xyzpassword --docker-email=xyz@mail.com --namespace=default
  
  ```
  
  Write the secret to a new yaml:
  
  ```
  $ kubectl get secret docker-credential -o yaml > key-alt.yaml
  
  ```
  
  Edit the file so it looks like (I could have left the docker-registry out):
  
  ```
  apiVersion: v1
  data:
    config.json: ewoJImF1***SIKCQl9Cgl9Cn0=
  kind: Secret
  metadata:
    name: docker-credential-3
    namespace: default
  
  ```
  
  Create the secret:
  
  ```
  $ kubectl apply -f key-alt.yaml
  
  ```
  
  The 'red herring' was that you normally generate a docker secret using the type 'docker-registry'. It will create the secret with the key '.dockerconfig'. The Tekton task uses a different route: it requires the 'config.json' as the key of the Secret resource.
  
  
  ---
  
  