10

I'm building a Docker image using a Jenkins pipeline (using a pipeline script that was auto-generated by JHipster). I want to push my final docker image to the Google Container Registry.

Here's what I've done:

  1. I've installed both the CloudBees Docker Custom Build Environment Plugin and the Google Container Registry Auth Plugin.
  2. I've set up Google auth credentials in Jenkins following instructions over here
  3. I've configured my build step to use the Google Registry tag format, like so: docker.build('us.gcr.io/[my-project-id]/[my-artifact-id]', 'target/docker')
  4. I've referenced the id of my Google Auth credentials in my push step:

(Hm. Needs extra text line after bullets to format properly) 

docker.withRegistry('https://us.gcr.io', '[my-credential-id]') {
    dockerImage.push 'latest'
}

But the build fails with:

ERROR: Could not find credentials matching [my-credential-id] 
Finished: FAILURE

I'm basically at the point of believing that these plugins don't work in a pipelines world, but I thought I'd ask if anyone has accomplished this and could give me some pointers.

bcholmes
  • 944
  • 1
  • 9
  • 23

5 Answers5

15

Try prefixing your credentials id by "gcr:".

Your credential id would look like "gcr:[my-credential-id]".

Complete working example:

stage('Build image') {
  app = docker.build("[id-of-your-project-as-in-google-url]/[name-of-the-artifact]")
}
stage('Push image') {
  docker.withRegistry('https://eu.gcr.io', 'gcr:[credentials-id]') {
    app.push("${env.BUILD_NUMBER}")
    app.push("latest")
  }
}

Please note the name of the image. I was struggling with pushing of the image even with working credentials until I've named the image wit [id-of-your-project-as-in-google-url]/[name-of-the-artifact] notation.

When you get a message that you need to enable the Google....... API, you probably got your [id-of-your-project-as-in-google-url] wrong.

Images can now be successfully used with url of eu.gcr.io/[id-of-your-project-as-in-google-url]/[name-of-the-artifact]:47.

LZ

LZaruba
  • 196
  • 6
  • That's certainly helped. I'm no longer getting a "Could not find credentials" error, but I'm stuck on a `unauthorized: Not Authorized` error. Thanks for the pointer! – bcholmes Sep 27 '17 at 19:59
  • 1
    And moments after I wrote that comment, I tried clearing out everything from my `.docker/config.json` and that seems to have helped. – bcholmes Sep 27 '17 at 20:01
  • 1
    Couple of hours after writing my response I ended up with working solution. I've updated the answer to reflect the solution. – LZaruba Sep 28 '17 at 06:20
  • In the build stage, I use the three part name: "us.gcr.io/[project-name]/[artifact-name]". But if the two-part name works for you, great! – bcholmes Sep 28 '17 at 13:13
  • Regarding the "clearing out everything from my `.docker/config.json`" comment: I can get some weird behaviour if I mix-and-match the use of the trailing slash in `docker.withRegistry('https://us.gcr.io/', '[my-credential-id]')`. That seems to cause `.docker/config.json` to contain multiple references to the repo (some with trailing slashes and some without). – bcholmes Nov 16 '17 at 17:36
  • This gcr: prefix solution didn't work for me unfortunately. Jenkins Pipeline docs state that the credentials for docker.withRegistry should refer to Username Password credentials. – u-phoria Mar 25 '18 at 20:26
  • 4
    @u-phoria: the gcr: prefix assumes you have the Google Container Registry Auth plugin installed in your Jenkins server. – bcholmes May 16 '18 at 12:33
  • I also needed to install the **Google Container Registry Auth** plugin and use the gcr: prefix to make it work. For me it did NOT work in any other way. – FireGnome Nov 08 '18 at 13:05
  • Another note for beginners: the above Complete working example needs to be in a `node {}` block: https://jenkins.io/doc/book/pipeline/syntax/#declarative-pipeline – Lewen Jul 09 '19 at 11:32
  • I can't believe how many of these insights are missing from published documentation – Arseniy Banayev Oct 04 '22 at 02:53
1

The previous answers didn't seem to work for me anymore. This is the syntax that works for me:

stage('Push Image') {
        steps {
            script {
                docker.withRegistry('https://gcr.io', 'gcr:my-credential-id') {
                    dockerImage.push()
                }
            }
        }
    }
Stijn Diependaele
  • 568
  • 4
  • 13
1

Other way of setting up Google cloud registry can be as below where you use withCredentials plugin and use file credential type.

withCredentials([file(credentialsId: 'gcr-private-repo-reader', variable: 'GC_KEY')]){
                sh '''
                    chmod 600 $GC_KEY
                    cat $GC_KEY | docker login -u _json_key --password-stdin https://eu.gcr.io

                    docker ps
                    docker pull eu.gcr.io/<reponame>/<image>
                '''
                }
Shambu
  • 2,612
  • 1
  • 21
  • 16
0

check if you have https://plugins.jenkins.io/google-container-registry-auth/ plugin installed.

After plugin installed use gcr:credential-id synthax

VictorB
  • 146
  • 5
-2

The below answer didn't completely work before, and is apparently now deprecated. I'm leaving the text here for historical reasons.

I've ultimately bypassed the problem by using a gcloud script stage in place of a docker pipeline stage, like so:

stage('publish gcloud') {
    sh "gcloud docker -- push us.gcr.io/[my-project-id]/[my-artifact-id]"
}

The gcloud command is able to find the auth credentials that are set up using a gcloud init on the command line of the Jenkins server.

bcholmes
  • 944
  • 1
  • 9
  • 23
  • I've seen the gcloud command come back with "Not Authorized" a coupl'a times. Perhaps the authorization times out? – bcholmes Aug 28 '17 at 22:03
  • Yeah, the gcloud command loses its authorization information fairly quickly. This isn't a viable on-going solution. – bcholmes Sep 07 '17 at 18:55
  • [This](https://stackoverflow.com/questions/38764193/google-cloud-jenkins-gcloud-push-access-denied) question suggests an alternative approach. – bcholmes Sep 27 '17 at 20:05
  • 1
    This is now deprecated in the newer gcloud. – c9s May 16 '18 at 04:30