#How to use WithRegistryAuth and GAR

1 messages · Page 1 of 1 (latest)

frigid trout
#

I'm trying to use this method directly because of token expiration in long builds.

  • docker can push
  • dagger can push without this step
    So am I using this incorrectly?
        // username := "jenkins@foo-dev.iam.gserviceaccount.com"
                // ideally we use a service account here, neither works however
        username := "tony@foo.com"

        // get fresh auth creds because GCP oauth is quite short-lived
        out, err := exec.Command("gcloud", "auth", "print-access-token", "--account", username).CombinedOutput()
        if err != nil {
            return fmt.Errorf("while refreshing auth to registry: %w", err)
        }
        token := rt.Dagger.SetSecret("gcp-oauth-token", string(out))

        registry := "us-central1-docker.pkg.dev"

        // publish to GCR/GAR
        _, err = comp.Final.
            WithRegistryAuth(
                registry,
                username,
                token,
            ).
            Publish(rt.Ctx, uri)

No matter the incantation, I get a 405 method not allowed

failed to export: failed to push us-central1-docker.pkg.dev/foo-dev/eng/foo/backup-db:feature-di-1205-fedx-poc-local: failed to authorize: failed to fetch oauth token: unexpected status from POST request to https://us-central1-docker.pkg.dev/v2/token: 405 Method Not Allowed
frigid trout
#

Here's what ended up working, note the username is not the same as the account name

        username := "jenkins@foo-dev.iam.gserviceaccount.com"

        // get fresh auth creds becuase GCP oauth is quite short-lived
        out, err := exec.Command("gcloud", "auth", "print-access-token", "--account", username).CombinedOutput()
        if err != nil {
            return fmt.Errorf("while refreshing auth to registry: %w", err)
        }
        token := rt.Dagger.SetSecret("gcp-oauth-token", string(out))

        // publish to GAR
        _, err = comp.Final.
            WithRegistryAuth(
                uri,  // full image URI  (<repo>/<img>:<tag>)
                "oauth2accesstoken",
                token,
            ).
            Publish(rt.Ctx, uri)
        if err != nil {
            return fmt.Errorf("while uploading image to registry (%s) on host: %w", uri, err)
        }
unreal sigil
#

@frigid trout would you say this should be escalated to an engine bug report on github?

frigid trout
#

hmm, as far as Dagger goes, the above function could use a bit more documentation

w.r.t. expiring tokens, that seems like something the underlying system should be handling the refresh on so I don't need to use this function to begin with

cobalt plaza
frigid trout
#

I suspect there are edge cases with the above work around

frigid trout
cobalt plaza
frigid trout
#

If this is buildkit, I wouldn't be surprised if there was a reproducer if you have a 1h build, unless the auth obtain at pull & push

#

unless b/c docker makes those steps explicitly separate, you don't really see it, not sure if buildx would have similar workflow to dagger (build+push in one command)

cobalt plaza
#

I'd "assume" it's evaluated on-demain as soon as publish is called. But not 100% sure about it

cobalt plaza
frigid trout