Could not find credentials after latest release

marcingryska commented 1 month ago

Jenkins and plugins versions report

Environment

What Operating System are you using (both controller, and any agents involved in the problem)?

Debian

Reproduction steps

A command used to work properly with previous version i.e 1.114.vfd22430621f5:

                    docker.withRegistry(config["ecr_url"], ecr_credentials_preffix + config["credentials"]) {
                        app.push("${env.BUILD_NUMBER}")
                        app.push("latest")
                        if (buildNumber != null) {
                            app.push("ssng_${env.BRANCH_NAME}_${buildNumber}")
                        }
                    }

now (version of 1.136.v914ea_5948634) it produces exception of not found credentials.

Expected Results

push to ECR successful

Actual Results

Exception occurs: hudson.AbortException: Could not find credentials matching credentials:here

TobiX commented 1 month ago

Can you check if this incremental was still working? (I'm currently far away from any usable AWS credentials, so I cannot test myself)

https://repo.jenkins-ci.org/artifactory/incrementals/com/cloudbees/jenkins/plugins/amazon-ecr/1.132.v88c326c2041e/amazon-ecr-1.132.v88c326c2041e.hpi

If this is the case, the bug was most likely introduced with c45fcef0d1a25b3b0b633fcbadab2b254d525dd5 and I missed some acegisecurity to spring security migration...

marcingryska commented 1 month ago

Thanks for a quick reaction I'll try to check it and give you a feedback then.

marcingryska commented 1 month ago

@TobiX I confirm it works properly with the 1.132.v88c326c2041e so please apply it/revert into latest stable version.

TobiX commented 1 month ago

I'd rather not revert the change, since it is a future-proving migration. I wrote a simple test case (and documentation how to use it) for the functionality of this plugin in #182, which proves the basic functionality still works... Maybe you could provide a minimal reproducer for your usecase, so we can find what is broken?

TobiX commented 1 month ago

A thing which changed with the modernisation it that DomainRequirements are now passed through when looking up credentials. So if your credential domains are defined too restricted, they will not be found...

marcingryska commented 1 month ago

@TobiX Thank you. I see I need to check whether such test is possible in our Jenkins, as we rather do not want to set sensitive data as env variables, could you additionally explain what do you meant by saying

credential domains are defined too restricted

What kind of restriction level?

TobiX commented 1 month ago

credential domains are defined too restricted

What kind of restriction level?

Jenkins credential domains can have specifications regarding their validity. Those were ignored before the latest versions, but are honoured now: grafik

(Not sure if the previous behaviour was a bug or a conscious omission, but I was under the impression that users using this feature would be aware of how it works)

marcingryska commented 1 month ago

Thank you, now clear to me let me check then with changed domain settings

marcingryska commented 1 month ago

@TobiX Indeed that was a brilliant remark, we had obsolete domains set there, now after setting them to up to date ones it works like a charm. Thank you for you help.

TobiX commented 4 weeks ago

@marcingryska Thanks for the confirmation. Maybe this needs a documentation update... Feel free to close this issue if the issue is fixed for you!

jenkinsci / amazon-ecr-plugin