流水线内IBM Cloud Container Registry登录失败问题求助

尝试通过Tekton任务登录IBM Cloud Container Registry用于Buildah部署，使用以下任务配置：

- name: login1
  taskRef:
    name: ibmcloud
  params:
  - name: ARGS
    value: 
      - "login"
      - "--apikey=$(params.ibmcloud-api-key)"
      - "-g"
      - "production"
      - "-r"
      - "$(params.ibmcloud-region)"

- name: cr-login
  taskRef:
    name: ibmcloud
  params:
  - name: ARGS
    value: 
      - "cr"
      - "login"
  runAfter:
    - login1

执行后login1任务认证成功，但cr-login任务失败，错误输出如下：

[login1 : ibmcloud] API endpoint: https://cloud.ibm.com
[login1 : ibmcloud] Authenticating...
[login1 : ibmcloud] OK
...
[cr-login : ibmcloud] 
[cr-login : ibmcloud] Warning: an error occurred while checking updates for plug-in 'container-registry':
[cr-login : ibmcloud] Could not get plugins from repository: invalid character '<' looking for beginning of value
[cr-login : ibmcloud] Use 'ibmcloud config --check-version=false' to disable update check.
[cr-login : ibmcloud] 
[cr-login : ibmcloud] FAILED
[cr-login : ibmcloud] You are not logged in to IBM Cloud.
[cr-login : ibmcloud] Log in by running the 'ibmcloud login' command.

1. 解决跨任务会话不共享问题 #

Tekton中每个独立task运行在不同的Pod容器里，IBM Cloud CLI的登录会话默认存储在容器本地的~/.bluemix目录，无法跨任务共享。需要通过共享Workspace保存CLI配置，让多个任务复用登录状态：

步骤1：定义共享Workspace #

在Pipeline中添加PersistentVolumeClaim类型的Workspace，用于存储IBM Cloud CLI配置：

workspaces:
  - name: ibmcloud-config
    persistentVolumeClaim:
      claimName: your-pvc-name  # 替换为你的PVC名称

步骤2：修改任务挂载Workspace #

确保每个ibmcloud任务都挂载该Workspace到CLI配置目录（默认/root/.bluemix）：

- name: login1
  taskRef:
    name: ibmcloud
  workspaces:
    - name: config
      workspace: ibmcloud-config
  params:
  - name: ARGS
    value: 
      - "login"
      - "--apikey=$(params.ibmcloud-api-key)"
      - "-g"
      - "production"
      - "-r"
      - "$(params.ibmcloud-region)"

- name: cr-login
  taskRef:
    name: ibmcloud
  workspaces:
    - name: config
      workspace: ibmcloud-config
  params:
  - name: ARGS
    value: 
      - "cr"
      - "login"
  runAfter:
    - login1

步骤3：确保IBM Cloud任务支持Workspace挂载 #

检查ibmcloud任务的定义，确认已配置Workspace挂载到/root/.bluemix：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: ibmcloud
spec:
  workspaces:
    - name: config
      description: 存储IBM Cloud CLI配置的Workspace
      mountPath: /root/.bluemix
  params:
    - name: ARGS
      type: array
      description: IBM Cloud CLI命令参数
  steps:
    - name: ibmcloud
      image: ibmcom/ibmcloud-cli:latest  # 使用官方IBM Cloud CLI镜像
      command: ["ibmcloud"]
      args: $(params.ARGS)

2. 禁用插件版本检查解决警告错误 #

插件更新检查的错误会干扰CLI执行，直接全局禁用版本检查即可：

添加禁用版本检查的任务 #

在login1之后、cr-login之前新增一个任务：

- name: disable-version-check
  taskRef:
    name: ibmcloud
  workspaces:
    - name: config
      workspace: ibmcloud-config
  params:
  - name: ARGS
    value: 
      - "config"
      - "--check-version=false"
  runAfter:
    - login1

然后修改cr-login的runAfter依赖：

- name: cr-login
  taskRef:
    name: ibmcloud
  workspaces:
    - name: config
      workspace: ibmcloud-config
  params:
  - name: ARGS
    value: 
      - "cr"
      - "login"
  runAfter:
    - disable-version-check

3. 备选方案：合并命令到同一任务 #

如果不想配置Workspace，可以将登录和CR登录命令合并到同一个任务中（同一容器内执行，会话自然共享）：

- name: ibmcloud-full-login
  taskRef:
    name: ibmcloud-shell  # 需要一个支持shell执行的任务
  params:
  - name: COMMAND
    value: |
      ibmcloud login --apikey=$(params.ibmcloud-api-key) -g production -r $(params.ibmcloud-region) && \
      ibmcloud config --check-version=false && \
      ibmcloud cr login

对应的ibmcloud-shell任务定义示例：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: ibmcloud-shell
spec:
  params:
    - name: COMMAND
      type: string
      description: 要执行的shell命令
  steps:
    - name: run-command
      image: ibmcom/ibmcloud-cli:latest
      command: ["sh"]
      args: ["-c", "$(params.COMMAND)"]

内容的提问来源于stack exchange，提问作者Yahya