question

HubertJ-5865 avatar image
0 Votes"
HubertJ-5865 asked vipullag-MSFT commented

Selective failure pulling container from acr

After a machine reboot on a cloud provider that is not Azure, I have a problem pulling the images.
Details:
Kubernetes 1.19.4
Image required through helm, with a secret docker-registry containing:
docker-email
docker-username
docker-server
docker-password
Error:
Mar 29 17:41:53 cluster-host1 dockerd[xxx]: time="2021-03-29T17:41:53.nnn+02:00" level=info msg="Attempting next endpoint for pull after error: Get https://ourcr.azurecr.io/v2/ourrepo/manifests/latest: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."
Mar 29 17:41:53 cluster-host dockerd[xxx]: time="2021-03-29T17:41:53.nnn+02:00" level=error msg="Handler for POST /v1.40/images/create returned error: Get https://ourcr.azurecr.io/v2/ourrepo/manifests/latest: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."

I have tried various actions, including logging with the same user and password from my dev machine on az acr (success), perform a
docker login
on the cluster-host1 (success)

The puzzling thing is that another image pull few seconds apart for another container from the same cluster succeeds!
I fail to understand what is the difference.
We are using access keys with the password directly, and it has been working for months now.
Thanks for any hint. Hubert J.

azure-container-registry
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

anonymous userJ-5865

Thank you for reaching out to us. Happy to help.

If it happened in one instance and after a few seconds, the same operation succeeded then this needs deeper investigation. I would recommend to open a support case, so that a support engineer can troubleshoot with the logs.

However, the other possibility is that the token might be mapped to a repository and requests to that repo is failing (might not be the case; just a assumption)

If you do not have the ability to open a support case, let me know, I can help with that.

0 Votes 0 ·

0 Answers