<p>I have been struggling to push a docker image to a Google Container Registry using fabric8 maven plugin on a Jenkins pipeline. I have checked every question on stackoverflow but none of them solved my problem.</p>

<p>This is my setup:</p>

<p>Kubernetes Cluster running on Google Kubernetes Engine. I have deployed a pod with a Jenkins server that starts agents with the Kubernetes CI plugin, based on this custom image:</p>

<pre><code>FROM openjdk:8

RUN apt-get update &amp;&amp; \
    apt-get -y install \
    apt-transport-https \
    ca-certificates \
    curl \
    software-properties-common
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
RUN add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu xenial stable" &amp;&amp; \
    apt-get update &amp;&amp;  \
    apt-get -y install docker-ce

RUN curl https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz &gt; /tmp/google-cloud-sdk.tar.gz

RUN mkdir -p /usr/local/gcloud \
  &amp;&amp; tar -C /usr/local/gcloud -xvf /tmp/google-cloud-sdk.tar.gz \
  &amp;&amp; /usr/local/gcloud/google-cloud-sdk/install.sh

ENV PATH $PATH:/usr/local/gcloud/google-cloud-sdk/bin
</code></pre>

<p>This agent has Java 8 and Docker.</p>

<p>I want to use fabric8 maven plugin to perform the docker image build and push to Google Container Registry. The point is no matter what I do I always end up facing this error (unauthorized): </p>

<blockquote>
  <p>Unable to push 'eu.gcr.io/myprojectid/gke-springboot-sample'
  from registry 'eu.gcr.io' : unauthorized: You don't have the needed
  permissions to perform this operation, and you may have invalid
  credentials. To authenticate your request, follow the steps in:
  <a href="https://cloud.google.com/container-registry/docs/advanced-authentication" rel="nofollow noreferrer">https://cloud.google.com/container-registry/docs/advanced-authentication</a>
  -> [Help 1]</p>
</blockquote>

<p>NOTE: </p>

<ol>
<li><p>I have created a service account associated to my GC project and given it these permissions: project editor and storage admin.</p></li>
<li><p>I have configured a Global Jenkins Secret (cloud-registry-credentials) associated to the key.json file belonging to that service account</p></li>
</ol>

<p>There are all the things I have tried in my pipeline so far:</p>

<p><strong>1: oauth2accesstoken</strong> </p>

<pre><code>stage("Build docker image") {
    agent {
        label 'jenkins-slave'
    }
    steps {
        container('jenkins-slave'){
            script {
                sh "./mvnw clean build fabric8:build"
                withCredentials([file(credentialsId: 'cloud-registry-credentials', variable: 'crc')]) {
                    sh "gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://eu.gcr.io"
                    sh "./mvnw fabric8:push"
                }
            }
        }
    }
}
</code></pre>

<p><strong>OUTPUT:</strong></p>

<pre><code>+ gcloud auth print-access-token
+ docker login -u oauth2accesstoken --password-stdin https://eu.gcr.io

WARNING! Your password will be stored unencrypted in /home/jenkins/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

[Pipeline] sh
Running shell script
+ ./mvnw fabric8:push

[INFO] F8&gt; The push refers to a repository [eu.gcr.io/myprojectid/gke-springboot-sample]
#
[ERROR] F8&gt; Unable to push 'eu.gcr.io/projectid/gke-springboot-sample' from registry 'eu.gcr.io' : unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication  [unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication ]
</code></pre>

<p><strong>2: key.json</strong> </p>

<pre><code>stage("Build docker image") {
    agent {
        label 'jenkins-slave'
    }
    steps {
        container('jenkins-slave'){
            script {
                sh "./mvnw fabric8:build"
                withCredentials([file(credentialsId: 'cloud-registry-credentials', variable: 'crc')]) {
                    sh "docker login -u _json_key --password-stdin https://eu.gcr.io &lt; ${crc}"
                    sh "gcloud auth activate-service-account --key-file=${crc}"
                    sh "./mvnw fabric8:push"
                }
            }
        }
    }
}
</code></pre>

<p><strong>OUTPUT:</strong></p>

<pre><code>+ docker login -u _json_key --password-stdin https://eu.gcr.io
WARNING! Your password will be stored unencrypted in /home/jenkins/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

[Pipeline] sh
 Running shell script

+ gcloud auth activate-service-account --key-file=****
Activated service account credentials for: [jenkins-cr@myprojectid.iam.gserviceaccount.com]

[Pipeline] sh
 Running shell script
+ ./mvnw fabric8:push

[ERROR] F8&gt; Unable to push 'eu.gcr.io/myprojectid/gke-springboot-sample' from registry 'eu.gcr.io' : unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication  [unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication ]
</code></pre>

codependent
<p>you might be looking for the Jenkins <a href="https://wiki.jenkins.io/display/JENKINS/Google+Container+Registry+Auth+Plugin" rel="nofollow noreferrer">Google Container Registry Auth Plugin</a>.</p>

<p>another possible reason may be, that the user <code>jenkins-cr</code> does not have the required role <code>storage.admin</code> assigned, in Cloud IAM... here's the relevant <a href="https://cloud.google.com/container-registry/docs/access-control" rel="nofollow noreferrer">documentation</a>. just seen you've assigned it; maybe double-check that.</p>

<p>you might also be able to get support <a href="https://github.com/fabric8io/fabric8-maven-plugin/issues" rel="nofollow noreferrer">there</a>, in case this is rather related to the fabric8 plugin.</p>

<p>also, hence it is a bucket, that bucket's <code>ACL</code> could eventually interfere.</p>
