Docker Hub Authentication

[jakeaturner]

Context

First off, thank you for this excellent service - it is saving a lot of headaches with adding Binder capabilities to an existing Jupyterhub cluster.

I have successfully spun up the binder service by following the docs and can access /services/binder/ to build images without issue. Where I'm stuck is pushing the built images to DockerHub: I always get error:
{"message": "denied: requested access to the resource is denied", "phase": "failed"}

I have tried creating a secrets.yaml file as the BinderHub docs suggest, but this results in:

Error: UPGRADE FAILED: values don't meet the specifications of the schema(s) in the following chart(s):
binderhub-service:
- (root): Additional property registry is not allowed

I have also tried passing the credentials using buildPodsRegistryCredentials from the docs:

config:
  BinderHub:
    base_url: /services/binder
    use_registry: true
    image_prefix: <docker-id>/binder-stage-
    # Temporarily enable the binderhub UI so we can test image building and pushing
    enable_api_only_mode: false
buildPodsRegistryCredentials:
  server: "https://registry-1.docker.io"
  username: <docker-id>
  password: <docker-pass>

or just simply:

config:
  BinderHub:
    base_url: /services/binder
    use_registry: true
    image_prefix: <docker-id>/binder-stage-
    # Temporarily enable the binderhub UI so we can test image building and pushing
    enable_api_only_mode: false
    registry:
      username: <docker-id>
      password: <docker-pass>

but all end in the same unauthorized error.

I know there's some discussions floating around there about similar errors with Binderhub, but at this point, I'm not even sure I'm passing the credentials as binderhub-service expects them.

Proposal

Any guidance on using DockerHub as the image repository would be appreciated.

Updates and actions

No response

[yuvipanda]

Maybe we need to upgrade the version of binderhub here to include jupyterhub/binderhub#1945?

[yuvipanda]

try the new build once #153 lands?

[jakeaturner]

Thank you for the quick response! I will definitely try the new build. Just to confirm though, passing credentials via buildPodsRegistryCredentials is the correct method binderhub-service expects?

[jakeaturner]

Hey @yuvipanda , sorry to dig this issue up from the grave: I've been fiddling around with this slowly over the past few weeks and haven't been able to get anywhere. I was looking through the logs and it does look the service is attempting to login and store docker credentials, but is not actually doing so. I'm getting "No username [password] for docker registry at https://index.docker.io/v1/", even though I do have them set in buildPodsRegistryCredentials, and so any subsequent calls to docker hub are failing with a 401:

I am on 0.1.0-0.dev.git.301.h1f89f00 BTW. Thanks for any insight you can provide!