Error Pulling Crossplane Provider Package: Access Denied for ghcr.io/vshn/provider-minio/package:latest

[AmazingTurtle]

Description

When attempting to deploy the Crossplane Provider resource with the package ghcr.io/vshn/provider-minio/package:latest, the process fails with an "access denied" error. This appears to be related to authentication or access issues with the GitHub Container Registry (GHCR).

Additional Context

No response

Logs

{"level":"info","ts":"2025-01-26T13:08:04Z","logger":"crossplane","msg":"TLS CA secret is empty or not complete, generating a new CA...","Step":"TLSCertificateGenerator"}
{"level":"info","ts":"2025-01-26T13:08:04Z","logger":"crossplane","msg":"Server certificates are empty or not complete, generating a new pair...","Step":"TLSCertificateGenerator","secret":"crossplane-tls-server"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Client certificates are empty or not complete, generating a new pair...","Step":"TLSCertificateGenerator","secret":"crossplane-tls-client"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Step has been completed","Name":"TLSCertificateGenerator"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Step has been completed","Name":"CoreCRDsMigrator"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Step has been completed","Name":"CoreCRDsMigrator"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Step has been completed","Name":"CoreCRDsMigrator"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Step has been completed","Name":"CoreCRDsMigrator"}
{"level":"info","ts":"2025-01-26T13:08:05Z","logger":"crossplane","msg":"Step has been completed","Name":"CoreCRDsMigrator"}
{"level":"info","ts":"2025-01-26T13:08:07Z","logger":"crossplane","msg":"Step has been completed","Name":"CoreCRDs"}
{"level":"info","ts":"2025-01-26T13:08:08Z","logger":"crossplane","msg":"Step has been completed","Name":"WebhookConfigurations"}
{"level":"info","ts":"2025-01-26T13:08:10Z","logger":"crossplane","msg":"Step has been completed","Name":"LockObject"}
{"level":"info","ts":"2025-01-26T13:08:10Z","logger":"crossplane","msg":"Step has been completed","Name":"PackageInstaller"}
{"level":"info","ts":"2025-01-26T13:08:10Z","logger":"crossplane","msg":"Step has been completed","Name":"StoreConfigObject"}
{"level":"info","ts":"2025-01-26T13:08:10Z","logger":"crossplane","msg":"Step has been completed","Name":"StepFunc"}
{"level":"info","ts":"2025-01-26T13:08:10Z","logger":"crossplane","msg":"Initialization has been completed"}
{"level":"info","ts":"2025-01-26T13:08:11Z","logger":"crossplane","msg":"Beta feature enabled","flag":"EnableBetaCompositionWebhookSchemaValidation"}
{"level":"info","ts":"2025-01-26T13:08:11Z","logger":"crossplane","msg":"Beta feature enabled","flag":"EnableBetaDeploymentRuntimeConfigs"}
Warning: ControllerConfig.pkg.crossplane.io/v1alpha1 is deprecated. Use DeploymentRuntimeConfig from pkg.crossplane.io/v1beta1 instead.

Expected Behavior

The package should be successfully pulled and installed as a Crossplane Provider.

Steps To Reproduce

1. Create a Provider resource with the following spec:

   apiVersion: pkg.crossplane.io/v1
   kind: Provider
   metadata:
     name: provider-minio
   spec:
     package: ghcr.io/vshn/provider-minio/package:latest

2. Apply the resource to the Kubernetes cluster.
3. Observe the following error in the resource status:

   status:
     conditions:
       - lastTransitionTime: '2025-01-26T13:31:54Z'
         message: >-
           cannot unpack package: failed to fetch package digest from remote:
           failed to fetch package descriptor with a GET request after a previous
           HEAD request failure: GET
           https://ghcr.io/token?scope=repository%3Avshn%2Fprovider-minio%2Fpackage%3Apull&service=ghcr.io:
           DENIED: requested access to the resource is denied: GET
           https://ghcr.io/token?scope=repository%3Avshn%2Fprovider-minio%2Fpackage%3Apull&service=ghcr.io:
           DENIED: requested access to the resource is denied
         reason: UnpackingPackage
         status: 'False'
         type: Installed
   

Versions

• Crossplane Version: 1.18.2
• Kubernetes Version: v1.31.0+k3s1

[rossigee]

Same here...

Status:
  Conditions:
    Last Transition Time:  2025-02-20T12:18:59Z
    Message:               cannot unpack package: failed to fetch package digest from remote: failed to fetch package descriptor with a GET request after a previous HEAD request failure: GET https://ghcr.io/token?scope=repository%3Avshn%2Fprovider-minio%2Fpackage%3Apull&service=ghcr.io: DENIED: requested access to the resource is denied: GET https://ghcr.io/token?scope=repository%3Avshn%2Fprovider-minio%2Fpackage%3Apull&service=ghcr.io: DENIED: requested access to the resource is denied
    Reason:                UnpackingPackage
    Status:                False
    Type:                  Installed

[rossigee]

Same here. Workaround...

spec:
  package: xpkg.upbound.io/vshn/provider-minio:v0.4.4