docker/dsengine.sh - CRG0009E: not authorized to access the specified account

[chiang-tan]

As a DataStage User
I want to test DataStage Anywhere on Docker (and subsequently on AWS)

I created

• $IBMCLOUD_APIKEY via https://cloud.ibm.com/iam/apikeys
• $ENCRYPTION_KEY & $ENCRYPTION_IV using openssl enc -aes-256-cbc -k secret -P -md sha1
• $IBMCLOUD_CONTAINER_REGISTRY_APIKEY via https://cloud.ibm.com/iam/serviceids/ServiceId
• $PROJECT_ID via https://dataplatform.cloud.ibm.com at Dallas region

When I ran

./dsengine.sh start -n 'remote_engine_name_01' \
                    -a "$IBMCLOUD_APIKEY" \
                    -e "$ENCRYPTION_KEY" \
                    -i "$ENCRYPTION_IV" \
                    -p "$IBMCLOUD_CONTAINER_REGISTRY_APIKEY" \
                    --project-id "$PROJECT_ID"

I encounter

{
    "code": "CRG0009E",
    "message": "You are not authorized to access the specified account. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-auth-req",
    "request-id": "309ad3ee-7bb2-4f6a-8570-2f4bfbf41632"
}

Tracing back to dsengine.sh, this was triggered while executing line 392 of dsengine.sh script.

icr_response=$(curl -s -X GET -H "accept: application/json" -H "Account: d10b01a616ed4b73a9ac8a052424a345" -H "Authorization: Bearer $CR_IAM_TOKEN" --url "https://icr.io/api/v1/images?includeIBM=false&includePrivate=true&includeManifestLists=true&vulnerabilities=true&repository=${PXRUNTIME_IMAGE_NAME}")

I have tried granting a lot of different Access (e.g. IBM Cloud Pak for Data, Container Registry, Cloud Object Storage, DataStage, IBM Cloud Projects) to the Service Id, but none of them can get me past the CRG0009E error while trying to access icr.io/datastage/ds-px-runtime

I believed, this may be due to my account not having access to the respistory icr.io/datastage/*

May I know how gain access to the repository?

If you notice I made any error during the setup, please do point it out as well.

[johnmckeever]

Any ideas, @brahmaroutu ?