Resolved

GitLab CI pipeline fails when switching from GitLab registry to Azure Container Registry

DevOps
CI/CD
GitLab
Azure
Docker
Container Registry
Authentication
Kubernetes

Authentication errors occur when migrating container builds from GitLab's built-in registry to Azure Container Registry (ACR) | Pipeline breaks due to missing ACR credentials and incorrect Docker auth configuration

Issue

The migration of container image builds from GitLab’s built-in registry to Azure Container Registry (ACR) encountered authentication and configuration errors across multiple stages of the CI/CD pipeline. Key problems included unauthorized access attempts when pushing images to ACR, missing credentials for multi-architecture manifest creation, and restricted access during image pull operations in smoke tests.

Culprit

The root causes of these failures were:

  1. Incompatible Authentication: The pipeline was configured to use GitLab’s registry credentials instead of Azure-specific credentials, which lack the necessary permissions for ACR operations.
  2. Missing Azure Credentials: The pipeline lacked Azure Service Principal credentials, which are required for secure authentication with ACR.
  3. Improper Image Naming: Image references did not follow ACR’s repository path structure, causing routing errors.
  4. Lack of Documentation: The required Azure-specific CI/CD variables were not documented, leading to configuration gaps.

Solution

To resolve these issues, the pipeline was updated with the following changes:

  • Registry Configuration: The pipeline was reconfigured to use ACR-specific variables, including the login server and the correct image naming convention.

  • Authentication Mechanism: Azure Service Principal credentials were integrated across all stages of the pipeline, ensuring secure and authorized access to ACR. This included configuring authentication for Docker builds, multi-architecture manifests, and smoke tests.

  • Security Implementation: Documentation was added for all required CI/CD variables, including Azure authentication details, registry settings, and security keys for image signing.

  • Service Principal Setup: An Azure Service Principal with appropriate permissions was created to facilitate secure and automated interactions between GitLab CI/CD and ACR.

  • Image Signing Integration: Cosign, a tool for container image signing, was implemented to ensure supply chain security for all images pushed to ACR.

These changes ensured seamless migration, secure authentication, and compliance with Azure’s security and configuration standards.