From 811025d29cfd00047fd14d8bc014cf16e52d5f74 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Wed, 2 Sep 2026 16:42:33 +0530 Subject: [PATCH] Fix docker push unauthorized: mount config.json, not .dockerconfigjson MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Confirmed via a direct token request to Harbor's own token endpoint (same username/password from harbor-robot-dockerconfig) that the robot account genuinely has push access to homelab/demo-go-app — Harbor returned a valid token with actions:[pull,push]. So the actual `docker push` failure ("unauthorized... action: push") wasn't a permissions problem at all. Root cause: kubernetes.io/dockerconfigjson secrets are required to store their data under the fixed key `.dockerconfigjson`. Mounting the secret without remapping that key meant the file that actually landed at /root/.docker was named `.dockerconfigjson`, not `config.json` — the only filename docker's CLI reads for stored credentials. Docker found nothing there and pushed unauthenticated, which Harbor correctly rejected. Adds an items: remap so the mounted file is named config.json. --- resources/org/homelab/dind-pod.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/resources/org/homelab/dind-pod.yaml b/resources/org/homelab/dind-pod.yaml index f6a3d33..38d643c 100644 --- a/resources/org/homelab/dind-pod.yaml +++ b/resources/org/homelab/dind-pod.yaml @@ -72,3 +72,18 @@ spec: - name: docker-config secret: secretName: harbor-robot-dockerconfig + # kubernetes.io/dockerconfigjson secrets store their data under + # the fixed key `.dockerconfigjson` (mandated, since that's what + # kubelet reads for imagePullSecrets) — without this remap, the + # mounted file at /root/.docker is literally named + # `.dockerconfigjson`, not `config.json`, which is the only + # filename the docker CLI itself ever reads for stored + # credentials. Docker found nothing there and silently pushed + # unauthenticated, which Harbor correctly rejected as + # unauthorized — confirmed the robot account/credentials + # themselves were fine the whole time by requesting a push token + # directly from Harbor's token endpoint with the same username/ + # password and getting one back with push access granted. + items: + - key: .dockerconfigjson + path: config.json