From 229416236178a26135dfa553d44bd1a38c4eb6fc Mon Sep 17 00:00:00 2001 From: tusharjadhav3302 Date: Tue, 4 Aug 2026 16:36:42 +0530 Subject: [PATCH 1/2] Fix quay-proxy SA login username PR #1933 switched the default CI registry to quay-proxy.ci.openshift.org and added a podman login in write_pull_secret() using --username "$(oc whoami)". For a ServiceAccount that returns system:serviceaccount::. The colons break HTTP Basic Auth password parsing on quay-proxy, so login fails with "invalid username/password" even when the CI token is valid. CI docs warn against this username form. Use a colon-free username ("image-puller"); the password remains the ServiceAccount token from oc whoami -t. Follow-up to #1933. Independent of #1937 (REGISTRY_CREDS). Signed-off-by: tusharjadhav3302 Co-authored-by: Cursor --- utils.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/utils.sh b/utils.sh index ba72baa7f..25b25b583 100755 --- a/utils.sh +++ b/utils.sh @@ -1026,10 +1026,13 @@ function write_pull_secret() { _tmpfiles="$_tmpfiles $tmppullsecret" # Pull secret for registry.ci.openshift.org (auto-discovered from the cluster) oc registry login --kubeconfig="$tmpkubeconfig" --to="$tmppullsecret" - # Pull secret for quay-proxy.ci.openshift.org + # Pull secret for quay-proxy.ci.openshift.org. + # Username must be colon-free: oc whoami returns + # system:serviceaccount:..., which breaks HTTP Basic Auth on quay-proxy. + # Docs: https://docs.ci.openshift.org/how-tos/use-registries-in-build-farm/ oc --kubeconfig="$tmpkubeconfig" whoami -t | \ podman login "${CI_REGISTRY}" \ - --username "$(oc --kubeconfig="$tmpkubeconfig" whoami)" \ + --username "image-puller" \ --password-stdin \ --authfile "$tmppullsecret" From 08910ea7fdb1331f52dc296cd8e03e43d488b6f2 Mon Sep 17 00:00:00 2001 From: tusharjadhav3302 Date: Tue, 4 Aug 2026 17:10:50 +0530 Subject: [PATCH 2/2] Use colon-safe whoami for quay-proxy login Hardcoding "image-puller" only covers the ServiceAccount CI path. Human users authenticate via Rover groups and should keep their oc whoami identity. Replace ':' with '_' in the username so ServiceAccount names stay Basic Auth safe while human usernames are unchanged when they contain no colons. Signed-off-by: tusharjadhav3302 Co-authored-by: Cursor --- utils.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/utils.sh b/utils.sh index 25b25b583..a11f65eb8 100755 --- a/utils.sh +++ b/utils.sh @@ -1027,12 +1027,13 @@ function write_pull_secret() { # Pull secret for registry.ci.openshift.org (auto-discovered from the cluster) oc registry login --kubeconfig="$tmpkubeconfig" --to="$tmppullsecret" # Pull secret for quay-proxy.ci.openshift.org. - # Username must be colon-free: oc whoami returns + # Replace ':' in the username: oc whoami for a ServiceAccount returns # system:serviceaccount:..., which breaks HTTP Basic Auth on quay-proxy. + # Humans (Rover) keep a usable whoami; SAs become colon-free. # Docs: https://docs.ci.openshift.org/how-tos/use-registries-in-build-farm/ oc --kubeconfig="$tmpkubeconfig" whoami -t | \ podman login "${CI_REGISTRY}" \ - --username "image-puller" \ + --username "$(oc --kubeconfig="$tmpkubeconfig" whoami | tr ':' '_')" \ --password-stdin \ --authfile "$tmppullsecret"