External Feeds Docker Hub Unauthorized

michael.gruber2 · 22 August 2023 14:35

I try to add a docker hub feed with the following config. Unfortunately I get always a unauthorized error message when I search for an image. The credentials are fine because I can login on docker hub with them. I can also access the url via the browser where octopus server is deployed. The octopus version is 2022.3.10847.

patrick.smergut · 22 August 2023 18:12

Hi @michael.gruber2,

Thanks for posting your issue, and welcome to the community!

I’m sorry to hear you’re experiencing that behavior, but it looks like you may be running into the following known issue:

github.com/OctopusDeploy/Issues

Docker Feeds throwing "401 - Unauthorized. Please check credentials" when creating releases/searching feeds.

opened 02:11AM - 27 Apr 23 UTC

closed 05:08AM - 27 Apr 23 UTC

IsaacCalligeros95

kind/bug area/core

### Severity All, blocking DockerHub feeds. Impacts release creation and search… ### Version All, Latest ### Latest Version I could reproduce the problem in the latest build ### What happened? DockerHub has changed requirements on scopes, this has broken DockerHub feeds when searching and creating releases. Error message: `401 - Unauthorized. Please check credentials.` * Create a DockerHub feed, hit save and test and search for images -> 💥 * Add a package to a deployment step using a docker feed. Create a release -> 💥 ### Reproduction * Create a DockerHub feed, hit save and test and search for images -> 💥 * Add a package to a deployment step using a docker feed. Create a release -> 💥 ### Error and Stacktrace ```shell 401 - Unauthorized. Please check credentials. Underlying error message Request to Docker registry located at `https://auth.docker.io/token?service=registry.docker.io&scope=registry:catalog:*` failed with BadRequest:Bad Request. {"details":"request scopes must be of the same resource type"} ``` ### More Information DockerHub has made an upstream change on required permission scopes that have impacted authentication. This has broken release creation and search for both V1 and V2 feeds. For V2 feeds we make a request to DockerHub, if that's UnAuthorized, we'll pull the auth details such as service and scope out of the header, make a token request and re-issue the original request. The scope that's being returned for this request is registry:catalog:* which is also hardcoded for out V1 endpoints. Tokens using this scope are facing permission issues across all endpoints. Updating this from `registry:catalog:*` to `registry:*` resolves this issue. ### Workaround NA

We’ve seen this behavior occurring with other users on Octopus versions close to yours, and upgrading has resolved this in their cases. Unfortunately, there isn’t a workaround noted or one that I’m aware of, so upgrading to or beyond one of the fixed versions listed in the issue would be our recommendation.

You might have seen it already, but we have a great upgrading guide in our documentation with common scenarios here:

I hope this is helpful, but let me know what you think.

Best regards,

Patrick

michael.gruber2 · 23 August 2023 13:18

Hi Patrick,

thank you very much.

Best regards

system · 23 September 2023 13:18

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.