[JIRA] (JENKINS-56405) Updating to Declarative 1.3.5 breaks docker agents authenticating against ECR using instance profiles

jenkins@rossmckelvie.com (JIRA)

unread,

Mar 4, 2019, 9:36:01 PM3/4/19

to jenkinsc...@googlegroups.com

Ross McKelvie updated an issue

Jenkins /

JENKINS-56405

Updating to Declarative 1.3.5 breaks docker agents authenticating against ECR using instance profiles

Change By:	Ross McKelvie
Summary:	Updating to Declarative 1.3.5 breaks docker agents using authenticating against ECR using instance profiles

Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

jenkins@rossmckelvie.com (JIRA)

unread,

Mar 4, 2019, 9:36:03 PM3/4/19

to jenkinsc...@googlegroups.com

Ross McKelvie updated an issue

Jenkins /

JENKINS-56405

Updating to Declarative 1.3.5 breaks docker agents authenticating against ECR using instance profiles

Change By:	Ross McKelvie

We have a Jenkins install that uses AWS ECR as a registry. We authenticate using the aws credentials chain (instance profile). Today we updated the Declarative plugin to 1.3.5 which broke all of our builds. Checking the changelog as Jira guidelines suggest do not include any changes to docker, however after reviewing the commit log in the repository it seems that JENKINS-49950 is an unlisted change between 1.3.4.1 and 1.3.5.

Pipeline code that worked prior to the update:

{code:java}
agent {
    docker {
        image 'base/php:7.2-cli'
        registryUrl "https://$DOCKER_REPOSITORY_HOST"
    }
}
{code}
After updating the plugin, the pipeline will not check the registry for the image.

Log output prior to update:

{noformat}
[Pipeline] // stage
[Pipeline] withEnv
[Pipeline] {
[Pipeline] withEnv
[Pipeline] {
[Pipeline] withDockerRegistry
[Pipeline] {
[Pipeline] sh
+ docker inspect -f . base/php:7.2-cli

Error: No such object: base/php:7.2-cli
[Pipeline] sh
+ docker inspect -f . 12345678910.dkr.ecr.us-east-1.amazonaws.com/base/php:7.2-cli{noformat}

Log output after updating:
{noformat}
[Pipeline] // stage
[Pipeline] withEnv
[Pipeline] {
[Pipeline] sh
+ docker inspect -f . base/php:7.2-cli

Error: No such object: base/php:7.2-cli
[Pipeline] sh
+ docker pull base/php:7.2-cli
Error response from daemon: pull access denied for base/php, repository does not exist or may require 'docker login'
{noformat}
We have never needed to provide the credentailsId, however commit [https://github.com/jenkinsci/pipeline-model-definition-plugin/commit/28d0aca0d9f4d54ee25e4d393a6683d92055aad3] appears to make this required. There was no indication that this would not be backwards compatible in the changelog.

Upon reverting the Declarative plugin to 1.3.4.1 has restored functionality. No other plugin needed to be rolled back.