如何在 Gitlab CICD 中使用 Kaniko？

Question

I am trying to use Kaniko with Gitlab in order to get rid of the DinD flow.

So, I have this in my.gitlab-ci.yaml

kaniko:
  stage: tagging

  variables:
    CI_REGISTRY: ${AZURE_REGISTRY_USERNAME_DEV}.azurecr.io
    CI_REGISTRY_USER: ${AZURE_REGISTRY_USERNAME_DEV}
    CI_REGISTRY_PASSWORD: ${AZURE_REGISTRY_PASS_DEV}

  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]

  script:
    #
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
    - >-
      /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/devops/Dockerfile"
      --destination "${CI_REGISTRY}/kanikotest:bla"
      --verbosity debug

  tags: # select gitlab-runner based on this tag(s)
    - docker
  only:
    refs:
      - /^feat.*$/

but I keep getting this error in the logs

error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "mysuperregistry.azurecr.io/kanikotest:bla": creating push check transport for mysuperregistry.azurecr.io failed: GET https://mysuperregistry.azurecr.io/oauth2/token?scope=repository%3Akanikotest%3Apush%2Cpull&service=mysuperregistry.azurecr.io: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.

I am following this guide .

Fun fact... I have successfully deployed Kaniko inside Minikube by creating a secret with the same creds, and I successfully pushed to the same registry.

Answer 1

The syntax of the auth file seems good (I assume the creds are correct), so your code should work if you just set the DOCKER_CONFIG environment variable as following:

kaniko:
  stage: tagging

  variables:
    CI_REGISTRY: ${AZURE_REGISTRY_USERNAME_DEV}.azurecr.io
    CI_REGISTRY_USER: ${AZURE_REGISTRY_USERNAME_DEV}
    CI_REGISTRY_PASSWORD: ${AZURE_REGISTRY_PASS_DEV}
    DOCKER_CONFIG: "$CI_PROJECT_DIR/kanikotest/.docker"

  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]

  script:
    - mkdir -p $DOCKER_CONFIG
    - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > $DOCKER_CONFIG/config.json
    - >-
      /kaniko/executor
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/devops/Dockerfile"
      --destination "${CI_REGISTRY}/kanikotest:bla"
      --digest-file "$CI_PROJECT_DIR/docker-content-digest-kanikotest"
      --verbosity info

  artifacts:
    paths:
      - docker-content-digest-kanikotest

Adding an extra directory ( kanikotest ) inside the DOCKER_CONFIG path will avoid concurrent builds to overwrite the same auth file (not required in your case example but a good practice in general).

The --digest-file option will permit also to save the image SHA for following CI jobs.