Dockerfile-maven: Google Container Registry: Unable to get access token (invalid_grant)

[bverhoeven]

I'm having an issue getting this plugin to work with a repository hosted on Google Container Registry (GCR).

When trying to build using the following configuration (as adapted from the configuration in README), it appears that the plugin fails to retrieve a valid access token from Google:

          <plugin>
                <groupId>com.spotify</groupId>
                <artifactId>dockerfile-maven-plugin</artifactId>
                <version>1.3.5</version>
                <executions>
                    <execution>
                        <id>default</id>
                        <goals>
                            <goal>build</goal>
                            <!--<goal>push</goal>-->
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <repository>gcr.io/xxx/yyy</repository>
                    <tag>${project.version}</tag>
                </configuration>
            </plugin>

unable to get access token for Google Container Registry, configuration for building image will not contain RegistryAuth for GCR
com.google.api.client.http.HttpResponseException: 400 Bad Request
{
  "error" : "invalid_grant"
}

I'm not sure if I need any additional configuration but manually running gcloud docker -a works fine, so I would suspect that there's not an issue with my local setup:

$ gcloud docker -a
Short-lived access for ['gcr.io', 'us.gcr.io', 'eu.gcr.io', 'asia.gcr.io', 'l.gcr.io', 'launcher.gcr.io', 'us-mirror.gcr.io', 'eu-mirror.gcr.io', 'asia-mirror.gcr.io', 'mirror.gcr.io'] configured.

Once I've done that I can push to GCR just fine (using docker push), but the plugin does not seem to use this configuration, or at least not for this step so that doesn't help.

Anonymized logs below:

[INFO] --- dockerfile-maven-plugin:1.3.5:build (default-cli) @ xxx ---
10:16:40.958 [main] DEBUG com.spotify.docker.client.DockerConfigReader - Using configfile: /Users/bas/.docker/config.json
[INFO] Using Google application default credentials
10:16:41.153 [main] INFO com.spotify.docker.client.auth.gcr.ContainerRegistryAuthSupplier - loaded credentials for user account with clientId=32555940559.apps.googleusercontent.com
10:16:41.215 [main] DEBUG com.spotify.docker.client.DockerCertificates - /Users/bas/.docker/ca.pem, /Users/bas/.docker/key.pem or /Users/bas/.docker/cert.pem does not exist, not using SSL
[INFO] Building Docker context /Users/bas/xxx
[INFO] 
[INFO] Image will be built as gcr.io/xxx/yyy:1.0.1
[INFO] 
10:16:42.880 [main] WARN com.spotify.docker.client.auth.gcr.ContainerRegistryAuthSupplier - unable to get access token for Google Container Registry, configuration for building image will not contain RegistryAuth for GCR
com.google.api.client.http.HttpResponseException: 400 Bad Request
{
  "error" : "invalid_grant"
}
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1054)
    at com.google.auth.oauth2.UserCredentials.refreshAccessToken(UserCredentials.java:207)
    at com.google.auth.oauth2.OAuth2Credentials.refresh(OAuth2Credentials.java:149)
    at com.spotify.docker.client.auth.gcr.ContainerRegistryAuthSupplier$DefaultCredentialRefresher.refresh(ContainerRegistryAuthSupplier.java:195)
    at com.spotify.docker.client.auth.gcr.ContainerRegistryAuthSupplier.getAccessToken(ContainerRegistryAuthSupplier.java:226)
    at com.spotify.docker.client.auth.gcr.ContainerRegistryAuthSupplier.authForBuild(ContainerRegistryAuthSupplier.java:295)
    at com.spotify.docker.client.auth.MultiRegistryAuthSupplier.authForBuild(MultiRegistryAuthSupplier.java:77)
    at com.spotify.docker.client.DefaultDockerClient.build(DefaultDockerClient.java:1388)
    at com.spotify.docker.client.DefaultDockerClient.build(DefaultDockerClient.java:1365)
    at com.spotify.plugin.dockerfile.BuildMojo.buildImage(BuildMojo.java:178)
    at com.spotify.plugin.dockerfile.BuildMojo.execute(BuildMojo.java:105)
    at com.spotify.plugin.dockerfile.AbstractDockerMojo.tryExecute(AbstractDockerMojo.java:227)
    at com.spotify.plugin.dockerfile.AbstractDockerMojo.execute(AbstractDockerMojo.java:216)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:101)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:209)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:84)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:59)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.singleThreadedBuild(LifecycleStarter.java:183)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:161)
    at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:320)
    at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:156)
    at org.apache.maven.cli.MavenCli.execute(MavenCli.java:537)
    at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:196)
    at org.apache.maven.cli.MavenCli.main(MavenCli.java:141)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:497)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:290)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:230)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:409)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:352)

Environment:

Apache Maven 3.0.5 (r01de14724cdef164cd33c7c8c2fe155faf9602da; 2013-02-19 14:51:28+0100)
Maven home: /Applications/NetBeans/NetBeans 7.4.app/Contents/Resources/NetBeans/java/maven
Java version: 1.8.0_45, vendor: Oracle Corporation
Java home: /Library/Java/JavaVirtualMachines/jdk1.8.0_45.jdk/Contents/Home/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "10.12.4", arch: "x86_64", family: "mac"

[bverhoeven]

Oops! Never mind.

This seems to be an issue on my side: Running gcloud auth application-default login created a new session and that seems to have fixed the issue.

I guess my authentication details had expired somehow.

[chabala]

This issue deserves to become part of the documentation. It wasn't clear how GCR needed to be configured to allow the push goal to work, nor is there even much mention of the push goal existing.

[mattnworb]

@chabala good idea, would you mind making a PR to add some text that you would find helpful? the readme refers to “application default credentials” and links to Google documentation but doesn’t say what CLI commands to run

[chabala]

I will endeavor to do so, though I know little of the how & why yet, only that raindancing the solution here allowed my authentication to proceed.

[mesutcelik]

Why is that printed although I have no intention to use GCR?
I understand it is warning but still a noise.

I was checking OpenLiberty Guide which uses minikube but seeing this warning made me feel that something is wrong.