Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-56405

Updating to Declarative 1.3.5 breaks docker agents authenticating against ECR using instance profiles

    Details

    • Similar Issues:

      Description

      We have a Jenkins install that uses AWS ECR as a registry. We authenticate using the aws credentials chain (instance profile). Today we updated the Declarative plugin to 1.3.5 which broke all of our builds. Checking the changelog as Jira guidelines suggest do not include any changes to docker, however after reviewing the commit log in the repository it seems that JENKINS-49950 is an unlisted change between 1.3.4.1 and 1.3.5.

      Pipeline code that worked prior to the update:

       

      agent {
          docker {
              image 'base/php:7.2-cli'
              registryUrl "https://$DOCKER_REPOSITORY_HOST"
          }
      }
      

      After updating the plugin, the pipeline will not check the registry for the image.

      Log output prior to update:

       

      [Pipeline] // stage
      [Pipeline] withEnv
      [Pipeline] {
      [Pipeline] withEnv
      [Pipeline] {
      [Pipeline] withDockerRegistry
      [Pipeline] {
      [Pipeline] sh
      + docker inspect -f . base/php:7.2-cli
      
      Error: No such object: base/php:7.2-cli
      [Pipeline] sh
      + docker inspect -f . 12345678910.dkr.ecr.us-east-1.amazonaws.com/base/php:7.2-cli

       

      Log output after updating:

      [Pipeline] // stage
      [Pipeline] withEnv
      [Pipeline] {
      [Pipeline] sh
      + docker inspect -f . base/php:7.2-cli
      
      Error: No such object: base/php:7.2-cli
      [Pipeline] sh
      + docker pull base/php:7.2-cli
      Error response from daemon: pull access denied for base/php, repository does not exist or may require 'docker login'
      

      We have never needed to provide the credentailsId, however commit https://github.com/jenkinsci/pipeline-model-definition-plugin/commit/28d0aca0d9f4d54ee25e4d393a6683d92055aad3 appears to make this required. There was no indication that this would not be backwards compatible in the changelog.

       Upon reverting the Declarative plugin to 1.3.4.1 has restored functionality. No other plugin needed to be rolled back. 

        Attachments

          Issue Links

            Activity

            rossmckelvie Ross McKelvie created issue -
            rossmckelvie Ross McKelvie made changes -
            Field Original Value New Value
            Summary Delcarative 1.3.5 breaks docker agents using ECR Declarative 1.3.5 breaks docker agents using ECR
            rossmckelvie Ross McKelvie made changes -
            Summary Declarative 1.3.5 breaks docker agents using ECR Updating to Declarative 1.3.5 breaks docker agents authenticating against ECR using instance profiles
            rossmckelvie Ross McKelvie made changes -
            Description We have a Jenkins install that uses AWS ECR as a registry. We authenticate using the aws credentials chain (instance profile). Today we updated the Declarative plugin to 1.3.5 which broke all of our builds. Checking the changelog as Jira guidelines suggest do not include any changes to docker, however after reviewing the commit log in the repository it seems that JENKINS-49950 is an unlisted change between 1.3.4.1 and 1.3.5.

            Pipeline code that worked prior to the update:

             
            {code:java}
            agent {
                docker {
                    image 'base/php:7.2-cli'
                    registryUrl "https://$DOCKER_REPOSITORY_HOST"
                }
            }
            {code}
            After updating the plugin, the pipeline will not check the registry for the image.

            Log output prior to update:

             
            {noformat}
            [Pipeline] // stage
            [Pipeline] withEnv
            [Pipeline] {
            [Pipeline] withEnv
            [Pipeline] {
            [Pipeline] withDockerRegistry
            [Pipeline] {
            [Pipeline] sh
            + docker inspect -f . base/php:7.2-cli

            Error: No such object: base/php:7.2-cli
            [Pipeline] sh
            + docker inspect -f . 12345678910.dkr.ecr.us-east-1.amazonaws.com/base/php:7.2-cli{noformat}
             

            Log output after updating:
            {noformat}
            [Pipeline] // stage
            [Pipeline] withEnv
            [Pipeline] {
            [Pipeline] sh
            + docker inspect -f . base/php:7.2-cli

            Error: No such object: base/php:7.2-cli
            [Pipeline] sh
            + docker pull base/php:7.2-cli
            Error response from daemon: pull access denied for base/php, repository does not exist or may require 'docker login'
            {noformat}
            We have never needed to provide the credentailsId, however commit [https://github.com/jenkinsci/pipeline-model-definition-plugin/commit/28d0aca0d9f4d54ee25e4d393a6683d92055aad3] appears to make this required. There was no indication that this would not be backwards compatible in the changelog.

             

             
            We have a Jenkins install that uses AWS ECR as a registry. We authenticate using the aws credentials chain (instance profile). Today we updated the Declarative plugin to 1.3.5 which broke all of our builds. Checking the changelog as Jira guidelines suggest do not include any changes to docker, however after reviewing the commit log in the repository it seems that JENKINS-49950 is an unlisted change between 1.3.4.1 and 1.3.5.

            Pipeline code that worked prior to the update:

             
            {code:java}
            agent {
                docker {
                    image 'base/php:7.2-cli'
                    registryUrl "https://$DOCKER_REPOSITORY_HOST"
                }
            }
            {code}
            After updating the plugin, the pipeline will not check the registry for the image.

            Log output prior to update:

             
            {noformat}
            [Pipeline] // stage
            [Pipeline] withEnv
            [Pipeline] {
            [Pipeline] withEnv
            [Pipeline] {
            [Pipeline] withDockerRegistry
            [Pipeline] {
            [Pipeline] sh
            + docker inspect -f . base/php:7.2-cli

            Error: No such object: base/php:7.2-cli
            [Pipeline] sh
            + docker inspect -f . 12345678910.dkr.ecr.us-east-1.amazonaws.com/base/php:7.2-cli{noformat}
             

            Log output after updating:
            {noformat}
            [Pipeline] // stage
            [Pipeline] withEnv
            [Pipeline] {
            [Pipeline] sh
            + docker inspect -f . base/php:7.2-cli

            Error: No such object: base/php:7.2-cli
            [Pipeline] sh
            + docker pull base/php:7.2-cli
            Error response from daemon: pull access denied for base/php, repository does not exist or may require 'docker login'
            {noformat}
            We have never needed to provide the credentailsId, however commit [https://github.com/jenkinsci/pipeline-model-definition-plugin/commit/28d0aca0d9f4d54ee25e4d393a6683d92055aad3] appears to make this required. There was no indication that this would not be backwards compatible in the changelog.

             Upon reverting the Declarative plugin to 1.3.4.1 has restored functionality. No other plugin needed to be rolled back. 
            Hide
            abayer Andrew Bayer added a comment -

            Ugh, sorry about that - taking a look now.

            Show
            abayer Andrew Bayer added a comment - Ugh, sorry about that - taking a look now.
            abayer Andrew Bayer made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            abayer Andrew Bayer made changes -
            Status In Progress [ 3 ] In Review [ 10005 ]
            Hide
            abayer Andrew Bayer added a comment -
            Show
            abayer Andrew Bayer added a comment - PR up at https://github.com/jenkinsci/pipeline-model-definition-plugin/pull/318 - sorry about that!
            abayer Andrew Bayer made changes -
            Remote Link This issue links to "PR #318 (Web Link)" [ 22446 ]
            Hide
            dantran dan tran added a comment -

            we are facing the exact same error, the docker registry is set at global configuration. [1]

            will the PR fix our issue as well?

            [1] https://groups.google.com/forum/#!topic/jenkinsci-users/zE8lkCN2s7s

            Show
            dantran dan tran added a comment - we are facing the exact same error, the docker registry is set at global configuration. [1] will the PR fix our issue as well? [1] https://groups.google.com/forum/#!topic/jenkinsci-users/zE8lkCN2s7s
            baaazen Mirko Hansen made changes -
            Link This issue is duplicated by JENKINS-56431 [ JENKINS-56431 ]
            Hide
            cosbug Constantin Bugneac added a comment -

            Facing the same issue.

            Show
            cosbug Constantin Bugneac added a comment - Facing the same issue.

              People

              • Assignee:
                abayer Andrew Bayer
                Reporter:
                rossmckelvie Ross McKelvie
              • Votes:
                3 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                • Created:
                  Updated: