Polling from private repository with token authentication fails with 401 UNAUTHORIZED

[dennismeissel]

Provider: Kubernetes.
Registry: Private docker registry with token authentication (cesanta/docker_auth)

The secret with a name dockerregistry was created with kubectl create secret then added to Pod spec:

spec:
  containers:
  - image: dockerregistry.mysite.com/myprivateimage:0.1.1
  imagePullSecrets:
    - name: dockerregistry

kubectl apply -f filename pulls images and installs everything correctly

But if I'm trying to add keel, I'm getting 401 UNAUTHORIZED in keel logs:

time="2020-01-24T11:26:37Z" level=error msg="trigger.poll.RepositoryWatcher.Watch: failed to add image watch job" error="Get https://dockerregistry.mysite.com/v2/myprivateimage/manifests/0.1.1: http: non-successful response (status=401 body="{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"myprivateimage","Action":"pull"}]}]}")" image="namespace:default,image:dockerregistry.mysite.com/myprivateimage:0.1.1,provider:kubernetes,trigger:poll,sched:@every 1m,secrets:[dockerregistry]"
time="2020-01-24T11:26:37Z" level=error msg="trigger.poll.manager: got error(-s) while watching images" error="encountered errors while adding images: Get https://dockerregistry.mysite.com/v2/myprivateimage/manifests/0.1.1: http: non-successful response (status=401 body="{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"myprivateimage","Action":"pull"}]}]}")"
time="2020-01-24T11:26:40Z" level=error msg="trigger.poll.RepositoryWatcher.addJob: failed to get image digest" error="Get https://dockerregistry.mysite.com/v2/myprivateimage/manifests/0.1.1: http: non-successful response (status=401 body="{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"myprivateimage","Action":"pull"}]}]}")" image="myprivateimage:0.1.1" password="**********" username=testuser

As you can see, keel gets the secret and username/password. But it doesn't work.

Also, if I find these requests in logs of the docker-registry, I see these errors:

error authorizing context: authorization token required
...
error authorizing context: malformed token

[dennismeissel]

I found out, why it fails.

Docker-Registry-Client used in this project accepts only token field.
Howewer it should also accept access_token field (according to Token Authentication Specification)

I created a pull-request that solves this problem

[rusenask]

yeah it does explain the failures :) good job! :)

[dennismeissel]

@rusenask,
Thanks for merging.
When will these changes affect the dockerhub image of keel?

[dennismeissel]

As I see, it's already there. Thank you.