Gitlab private registries not working with Knative v1.2

[ms1515]

Not able to fetch private images from gitlab on Knative v1.2. I can fetch private images from Docker with Knative v1.2, but not gitlab.

I can confirm that this is not a secrets issue, as I can pull images from Gitlab with my secret with earlier versions of Knative: v1.1.1, v1.1.0 etc.

In what area(s)?

Private Registries

What version of Knative?

1.2

Expected Behavior

Knative v1.2 should pull images from private registries in Gitlab with appropriate secrets provided.

Actual Behavior

Knative v1.2 cannot pull private images from Gitlab registries.

Steps to Reproduce the Problem

1. Setup a private container registry on Gitlab in your project.
2. Push an example image to it.
3. Setup a secret for gitlab-registry in Kubernetes environment with your credentials.

kubectl create secret docker-registry gitlab-auth \
  --docker-server=https://registry.gitlab.com \
  --docker-email=YOUR-GITLAB-EMAIL \
  --docker-username=YOUR-GITLAB-USERNAME \
  --docker-password=YOUR-GITLAB-ACCESS-TOKEN

4. Then either specify that secret in Knative-service.yaml file for your example project, or patch your service account with it.
5. Apply your example Knative-service.yaml using kn and you will get the following error:

Error: RevisionFailed: Revision "example-service" failed with message: Unable to fetch image "registry.gitlab.com/example-image-url": failed to resolve image to digest: GET https://gitlab.com/jwt/auth?scope=repository%!A(MISSING)example%!F(MISSING) example%!F(MISSING) example%!F(MISSING) example%!F(MISSING) example%!F(MISSING) example%!F(MISSING) example%!A(MISSING)pull&service=container_registry: DENIED: access forbidden.
Run 'kn --help' for usage

Note: I can confirm that this is not a secrets issue, as I can pull images from Gitlab with my secret with earlier versions of Knative: v1.1.1, v1.1.0 etc.

[dprotaso]

Confirmed the difference in behaviour. I think as a workaround for now you can use registry.gitlab.com as your docker server name - so drop the scheme (https).

[dprotaso]

/assign @dprotaso

[dprotaso]

@ms1515 this should be fixed in the latest 1.2 patch release

thanks for the report!