Unable to push docker images to packages

[Mahesh Murali]

docker login crg.apkg.io/rmituniversity/alz-iac-deploy -u user-email
When I try to push images
uelz-deployment-pipeline % docker push crg.apkg.io/rmituniversity/alz-iac-deploy:latest
The push refers to repository [crg.apkg.io/rmituniversity/alz-iac-deploy]
4d259e149220: Preparing
dffb3ad77836: Preparing
ebb83fe39ef8: Preparing
4a7caa5ea194: Preparing
c5ac12e764b6: Preparing
09276cfb9100: Waiting
9dc0e37e3f6d: Waiting
5f70bf18a086: Waiting
8760046bd5c1: Waiting
ea1e85f185a0: Waiting
fd60710b96d7: Waiting
a1d4b8c8cf4f: Waiting
59b223680ef9: Waiting
denied: requested access to the resource is denied
can you help me why?

[Joshua Tang]

Hi @Mahesh Murali

Thank you for testing out Bitbucket Packages and reporting the issue you experienced.

After tracing through the logs, we noticed that you used an API token without any scopes. Can you try creating a new API token with the `read:package:bitbucket` and `write:package:bitbucket` scopes? Then use that token to interact with Bitbucket's container registry.

Let me know if you encounter any other issues.

Kind regards,
Joshua

[Mahesh Murali]

hello @Joshua Tang 
thanks. It worked after I added scope token with read:package:bitbucket` and `write:package:bitbucket`.

I was able to push the image after setting 

ATLASSIAN_EMAIL and  API_TOKEN.

Is there some other setting for the bitbucket runners to pull the image
I had used

- step: &deploy-nonprod

name: '🚀 Deploy to Non-Production'

image:

name: crg.apkg.io/rmituniversity/uelz-application-onboarding:latest

username: $ATLASSIAN_EMAIL

password: $API_TOKEN

I am getting error
Container 'build' failed to pull image: 'failed to pull and unpack image "crg.apkg.io/rmituniversity/uelz-application-onboarding:latest": failed to resolve reference "crg.apkg.io/rmituniversity/uelz-application-onboarding:latest": failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://crg.apkg.io/auth/registry-token?scope=repository%3Armituniversity%2Fuelz-application-onboarding%3Apull&service=crg.apkg.io: 401 Unauthorized'

while I dont have issues when I pull in my local machine

[Joshua Tang]

Hi @Mahesh Murali

The configuration you have defined there should be sufficient to allow the Pipelines runner to pull the image. Are you able to confirm if you're setting the correct value in the $API_TOKEN variable? I was able to reproduce the error message you got when I set an invalid API token so wonder if this is the same issue you're experiencing.

Kind regards,
Joshua

[Mahesh Murali]

hello @Joshua Tang 
I was able to build and push the image using step

step: &build-push-image

name: '🐳 Build and Push Docker Image'

services:

- docker

condition:

changesets:

includePaths:

- "docker/**"

script:

- export IMAGE_NAME="crg.apkg.io/rmituniversity/uelz-application-onboarding"

- echo $API_TOKEN | docker login crg.apkg.io --username $ATLASSIAN_EMAIL --password-stdin

- cd docker

- docker build --tag "$IMAGE_NAME:latest" .

- docker build --tag "$IMAGE_NAME:$BITBUCKET_BUILD_NUMBER" .

- docker push "$IMAGE_NAME:latest"

- docker push "$IMAGE_NAME:$BITBUCKET_BUILD_NUMBER"
where API_TOKEN and ATLASSIAN_EMAIL are set as repo vars

while pulling

step: &deploy-nonprod-docker

name: '🚀 Deploy to Non-Production (Docker)'

deployment: nonprod

image:

name: crg.apkg.io/rmituniversity/uelz-application-onboarding:latest

username: $ATLASSIAN_EMAIL

password: $API_TOKEN

oidc: true

script:

- export AWS_REGION=ap-southeast-2

- export AWS_ROLE_ARN=arn:aws:iam::273354623525:role/uelz-pcs-application-onboarding-deployment-role

- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token

- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

- task deploy:nonprod
is what is erroring out

[Joshua Tang]

Hi @Mahesh Murali

I've check our access logs and it's showing that you've provided invalid credentials which resulted in the 401 error you're seeing.

Are the push and pull pipelines steps you shared running in the same repository with the same ATLASSIAN_EMAIL and API_TOKEN variables setup?

If we need to debug this further, can you raise a support ticket with us so that we can look into your instance and your setup?

Kind regards,
Joshua

[Mahesh Murali]

Hello @Joshua Tang 

Yes. They are just 2 steps in the same pipeline file. I can add that full file if you want.

sequence is first stage pushes the image and after a few scan stages, I am using this image using the same credentials 

I am happy to create a new support ticket. Could you guide me on how to raise that ticket

[Joshua Tang]

Okay maybe it's easier to look into your instance at this point as I can't reproduce the issue you're experiencing. You can raise a support ticket at https://support.atlassian.com/contact/ and link this community post. Then the support team should redirect the request to me to look into it further.

[Curtis]

I am having this same issue. The docker login is successful. I have the API Token given both package read and write permissions, but fails to successfully push to the package resource.

[Joshua Tang]

Hi @Curtis

Thank you for testing out Bitbucket Packages too. Our support team will be reaching out for more details about your Bitbucket workspace so we can trace through the logs in our systems.

Kind regards,
Joshua

[Curtis]

My issue turned out to be a simple one. The user didn't have write permissions to the repository. The API Token had the correct permissions.