GoogleContainerTools / kaniko

Build Container Images In Kubernetes
Apache License 2.0
14.89k stars 1.44k forks source link

Fix: Make `--registry-map` compatible with namespaced images #3138

Closed mlallaouret closed 6 months ago

mlallaouret commented 6 months ago

With --registry-map=="index.docker.io=europe-west1-docker.pkg.dev/my-registry/docker-hub", when we try to pull the image eclipse-temurin:21.0.2_13-jre, as expected we get:

INFO Retrieving image manifest eclipse-temurin:21.0.2_13-jre 
INFO Retrieving image my-registry/docker-hub/eclipse-temurin:21.0.2_13-jre from mapped registry europe-west1-docker.pkg.dev  

However with the same --registry-map option, when we try to pull the image caddy/caddy:2.7.6-alpine, we get:

INFO Retrieving image manifest caddy/caddy:2.7.6-alpine 
INFO Retrieving image caddy/caddy:2.7.6-alpine from mapped registry europe-west1-docker.pkg.dev 
WARN Failed to retrieve image caddy/caddy:2.7.6-alpine from remapped registry europe-west1-docker.pkg.dev: unable to complete operation after 0 attempts, last error: GET https://europe-west1-docker.pkg.dev/v2/token?scope=repository%3Acaddy%2Fcaddy%3Apull&service=: DENIED: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/caddy/locations/europe-west1/repositories/caddy" (or it may not exist). Will try with the next registry, or fallback to the original registry. 

Description

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you review them:

See the contribution guide for more details.

Reviewer Notes

Release Notes

Describe any changes here so maintainer can include it in the release notes, or delete this block.

Examples of user facing changes:
- Fix: Make `--registry-map` compatible with namespaced images
babs commented 6 months ago

Thanks for the namespace implem, I was thinking about it, you made it ;)