Workflow fails to pull image from private registry due to missing authentication

[diegoara96]

I am using GITHUB ARC with the containerMode = kubernetes with the default configuration and it works fine allowing my workflows to run in containers. The problem is that I wanted to use images from a private registry and from what I see in the workflow log I get the impression that it is not able to log against my registry.

Using the docker login locally with the credentials of the secrets and the image works so I discard that it is a problem on the part of the repository.

Workflow

name: backend-ci-services

 
on:
  push:
    branches:
      - 'main'
  pull_request:
    branches:
      - 'main'
  workflow_dispatch:

jobs:
  backend-ci:
    runs-on: [ arc-runner-set ]
    container:
      image: gradle:8.10.1-jdk21-alpine
    concurrency:
      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
    # Service containers to run with `container-job`
    services:
      # Label used to access the service container
      redis:
        image: redis
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      postgresdb:
        # Docker Hub image
        image: my.private.registry/project/postgresdb:latest
        credentials:
          username: ${{ secrets.HARBOR_USER }}
          password: ${{ secrets.HARBOR_PASS }}

kubernetes workflow description log

for 300s
Events:
  Type     Reason   Age              From     Message
  ----     ------   ----             ----     -------
  Normal   Pulled   7s               kubelet  Container image "gradle:8.10.1-jdk
21-alpine" already present on machine
  Normal   Created  7s               kubelet  Created container job
  Normal   Started  7s               kubelet  Started container job
  Normal   Pulling  7s               kubelet  Pulling image "redis"
  Normal   Pulled   6s               kubelet  Successfully pulled image "redis" 
in 846ms (846ms including waiting)
  Normal   Created  6s               kubelet  Created container redis
  Normal   Started  6s               kubelet  Started container redis
  Normal   Pulling  6s               kubelet  Pulling image "my.private.registry/project/postgresdb:latest"
  Warning  Failed   6s               kubelet  Failed to pull image "my.private.registry/project/postgresdb:latest": failed to pull and unpack image "my.private.registry/project/postgresdb:latest": failed to resolve reference "my.private.registry/project/postgresdb:latest": pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials
  Warning  Failed   6s               kubelet  Error: ErrImagePull
  Normal   BackOff  4s (x2 over 5s)  kubelet  Back-off pulling image "my.private.registry/project/postgresdb:latest"

[diegoara96]

UPDATE: I have tried changing the runner from an ARC to a self-hosted runner and it downloads the image without problems. I understand that then this is no longer a discussion and becomes a bug.

[diegoara96]

Issue: #3747