<p>Hey I'm creating a gitlab pipeline and I have 2 stages: staging and qa.
For staging I use gitlabs <code>auto-deploy</code> script and for qa I use a custom script.</p>
<p>With staging the pipeline works. For qa the container registry tells me the username/password is wrong:</p>
<pre><code>Events:
  Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Warning  Failed     4m48s (x4 over 6m9s)  kubelet            Failed to pull image &quot;&lt;container-url&gt;&quot;: rpc error: code = Unknown desc = unable to retrieve auth token: invalid username/password: unauthorized: HTTP Basic: Access denied
  Warning  Failed     4m48s (x4 over 6m9s)  kubelet            Error: ErrImagePull
  Normal   BackOff    4m8s (x7 over 6m8s)   kubelet            Back-off pulling image &quot;&lt;container-url&gt;&quot;
  Warning  Failed     64s (x20 over 6m8s)   kubelet            Error: ImagePullBackOff
</code></pre>
<p>during the pipeline I am creating a secret with login details to the registry.
Both pipelines create it with:</p>
<pre><code>  kubectl create secret -n &quot;$KUBE_NAMESPACE&quot; \
    docker-registry &quot;gitlab-registry-${CI_PROJECT_PATH_SLUG}&quot; \
    --docker-server=&quot;$CI_REGISTRY&quot; \
    --docker-username=&quot;${CI_DEPLOY_USER:-$CI_REGISTRY_USER}&quot; \
    --docker-password=&quot;${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}&quot; \
    --docker-email=&quot;$GITLAB_USER_EMAIL&quot; \
    -o yaml --dry-run | kubectl replace -n &quot;$KUBE_NAMESPACE&quot; --force -f -
</code></pre>
<p>Since I have no deploy token its defaulting to <code>username=$CI_REGISTRY_USER</code> and <code>password=$CI_REGISTRY_PASSWORD</code>.
I double checked and there is a secret in the respective namespaces.
Both secrets are the same except for the password, which is generated each time a pipeline is run (as far as I understand).</p>
<p>Finally I'm putting the secret in the deployment file:</p>
<pre><code>spec: 
  template:
    spec:
      imagePullSecrets:
        - &lt;name-of-secret&gt;
</code></pre>
<p>So this should give me access to the container registry, but it gives me the error above.
Whats the reason it works fine with <code>auto-deploy</code> but not for me?
The secret is created the same way so it should yield the same result.</p>
<p>Thanks for your help :)</p>
<p><strong>EDIT:</strong><br />
I added a deploy token under <code>project &gt; settings &gt; repository &gt; deploy tokens</code> and called it <code>gitlab-deploy-token</code>. It has all the rights and its login details are passed to the pipeline via <code>$CI_DEPLOY_USER</code> and <code>$CI_DEPLOY_PASSWORD</code>.</p>
<p>The error in the pod changed to:</p>
<pre><code>Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  ...
  Warning  Failed     13m (x4 over 15m)  kubelet            Failed to pull image &quot;&lt;image-url&gt;&quot;: rpc error: code = Unknown desc = Error reading manifest &lt;container-tag&gt; in &lt;registry-url&gt; errors: denied: requested access to the resource is denied unauthorized: authentication required
</code></pre>
<p>According to <a href="https://docs.gitlab.com/ee/user/project/deploy_tokens/index.html#gitlab-deploy-token" rel="nofollow noreferrer">gitlab documentation</a> I should be able to log in to the registry with <code>buildah login -u $CI_DEPLOY_USER -p $CI_DEPLOY_PASSWORD $CI_REGISTRY</code>.
But when I do that in the stage that is just login in and out of the registry I get:</p>
<pre><code>error authenticating creds for &quot;&lt;registry&gt;&quot;: pinging docker registry returned: Get &lt;link&gt;: net/http: TLS handshake timeout
</code></pre>
<p>with the link being a json file:</p>
<pre><code>errors: 
   0:   
      code:     &quot;UNAUTHORIZED&quot;
      message:  &quot;authentication required&quot;
      detail:   null
</code></pre>
<p>Since I'm providing username and password and the error does not complain about them mismatching I'm assuming this is working.
But why is the authentication still not going through? Is there something else needed to authenticate? Some certificates perhaps?</p>
<p>The staging pipeline (the one with <code>auto-deploy</code>) which is now also using the <code>gitlab-deploy-token</code> still works.</p>

iaquobe
<p>The secret you generate ($CI_REGISTRY_PASSWORD) is only valid during the specific job. So the moment the job finishes the password is invalid.</p>
<p>Use a deploy token.</p>
