GitLab CI/CD中Jib Maven插件认证失败问题排查

我们使用Jib Maven插件为Java 21项目构建Docker镜像，目标仓库是GitLab中独立的ourApp-registry项目。已在ourApp-registry的Settings -> CI/CD -> Job token permission中为ourApp-email项目授权，但流水线中docker login执行成功，Jib插件却报401未授权错误。

ourApp-email的.gitlab-ci.yml配置 #

image: maven:latest

stages:
  - build
  - deploy

build-job:
  stage: build
  script:
    - echo "Build job"
    - mvn compile -e
    
image-job:
  stage: deploy
  services:
  - docker:dind
  script:
    - echo "Image job"
    - apt-get update && apt-get install -y docker.io
    - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    - mvn compile jib:build

ourApp-email的pom.xml中Jib插件配置 #

<build>
    <finalName>${project.artifactId}</finalName>
    <plugins>
        <plugin>
            <groupId>com.google.cloud.tools</groupId>
            <artifactId>jib-maven-plugin</artifactId>
            <version>3.4.4</version>
            <configuration>
               <from>
                   <image>openjdk:21-jdk-slim</image>
                </from>
                <to>
                   <image>registry.gitlab.com/ourApp/ourApp-registry/${project.build.finalName}:${project.version}</image>
                   <auth>
                        <username>${env.CI_REGISTRY_USER}</username>
                        <password>${env.CI_REGISTRY_PASSWORD}</password>
                   </auth>
                </to>
            </configuration>
        </plugin>
    </plugins>
</build>

流水线错误信息 #

$ echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
$ mvn compile jib:build
[ERROR] I/O error for image [registry-1.docker.io/library/openjdk]:
[ERROR]     java.net.SocketException
[ERROR]     Socket closed
[ERROR] Failed to execute goal com.google.cloud.tools:jib-maven-plugin:3.4.4:build (default-cli) on project email: Build image failed, perhaps you should make sure your credentials for 'registry.gitlab.com/ourApp/ourApp-registry/email' are set up correctly. See https://github.com/GoogleContainerTools/jib/blob/master/docs/faq.md#what-should-i-do-when-the-registry-responds-with-unauthorized for help: Unauthorized for registry.gitlab.com/ourApp/ourApp-registry/email: 401 Unauthorized
[ERROR] POST https://registry.gitlab.com/v2/ourApp/ourApp-registry/email/blobs/uploads/
[ERROR] {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"ourApp/ourApp-registry/email","ProjectPath":"","Action":"pull"},{"Type":"repository","Class":"","Name":"ourApp/ourApp-registry/email","ProjectPath":"","Action":"push"}]}]}
ERROR: Job failed: exit code 1

原因及解决方法 #

核心问题 #

1. 默认CI变量权限不匹配：CI_REGISTRY_USER和CI_REGISTRY_PASSWORD是当前项目（ourApp-email）的仓库凭证，没有访问跨项目仓库ourApp-registry的权限。
2. 未使用GitLab Job Token认证：跨项目仓库授权需要用gitlab-ci-token作为用户名，CI_JOB_TOKEN作为密码，这才是你配置的Job Token授权对应的认证信息。

修复步骤 #

1. 修改pom.xml中的Jib认证配置
   替换<auth>块的凭证为GitLab Job Token专用信息：

   <to>
       <image>registry.gitlab.com/ourApp/ourApp-registry/${project.build.finalName}:${project.version}</image>
       <auth>
            <username>gitlab-ci-token</username>
            <password>${env.CI_JOB_TOKEN}</password>
       </auth>
   </to>
   

2. 简化CI流水线脚本
   Jib插件无需依赖Docker守护进程，直接去掉Docker相关步骤，优化后的image-job：

   image-job:
     stage: deploy
     script:
       - echo "Image job"
       - mvn compile jib:build
   

   同时可以移除services: - docker:dind和Docker安装命令，减少流水线执行成本。

3. 确认Job Token权限配置
   再次检查ourApp-registry的Settings -> CI/CD -> Job token permission，确保已添加ourApp-email项目，并勾选read_registry和write_registry权限。

内容的提问来源于stack exchange，提问作者micu