push images to registry get 401 error

[martin-bian]

What is version of KubeKey has the issue?

{"major":"4","minor":"0","gitVersion":"v4.0.2","gitCommit":"bd780ee397ff2abcc5d03975c32dae056ddb86c5","gitTreeState":"clean","buildDate":"2025-11-28T08:44:50Z","goVersion":"go1.23.3","compiler":"gc","platform":"linux/amd64"}

What is your os environment?

麒麟V10

KubeKey config file

apiVersion: kubekey.kubesphere.io/v1
kind: Config
spec:
  cni:
    calico_version: v3.28.2
    cilium_version: 1.15.4
    hybridnet_version: 0.6.8
    kubeovn_version: 1.13.0
    multus:
      image:
        tag: v4.3.0
  cri:
    container_manager: containerd
    containerd_version: v1.7.6
    crictl_version: v1.33.0
    cridockerd_version: v0.3.1
    docker_version: 24.0.7
    runc_version: v1.1.7
    sandbox_image:
      tag: "3.9"
  dns:
    dns_cache_image:
      tag: 1.24.0
    dns_image:
      tag: v1.12.1
  etcd:
    etcd_version: v3.5.11
  download:
    arch:
      - amd64
  image_registry:
    docker_registry_version: 2.8.3
    dockercompose_version: v2.20.3
    harbor_version: v2.10.1
    keepalived_version: 2.0.20
    type: harbor
  kubernetes:
    helm_version: v3.18.5
    kube_version: v1.33.3
  storage_class:
    local:
      linux_utils_image:
        tag: 4.2.0
      provisioner_image:
        tag: 4.2.0
    nfs_provisioner_version: 4.3.0
  image_manifests:
  # kubernetes-v1.33.3
  - docker.io/calico/apiserver:v3.28.2
  - docker.io/calico/cni:v3.28.2
  - docker.io/calico/csi:v3.28.2
  - docker.io/calico/kube-controllers:v3.28.2
  - docker.io/calico/node-driver-registrar:v3.28.2
  - docker.io/calico/node:v3.28.2
  - docker.io/calico/pod2daemon-flexvol:v3.28.2
  - docker.io/kubesphere/k8s-dns-node-cache:1.24.0
  - docker.io/openebs/provisioner-localpv:4.2.0
  - docker.io/openebs/linux-utils:4.2.0
  - docker.io/kubesphere/coredns:v1.12.1
  - docker.io/kubesphere/kube-apiserver:v1.33.3
  - docker.io/kubesphere/kube-controller-manager:v1.33.3
  - docker.io/kubesphere/kube-proxy:v1.33.3
  - docker.io/kubesphere/kube-scheduler:v1.33.3
  - docker.io/kubesphere/pause:3.9
  - quay.io/tigera/operator:v1.34.5
  - docker.io/calico/ctl:v3.28.2
  - docker.io/calico/typha:v3.28.2
  - docker.io/library/haproxy:2.9.6-alpine
  # ks-core
  - registry.cn-beijing.aliyuncs.com/kse/ks-apiserver:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kse/ks-console:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kse/ks-controller-manager:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kubesphereio/kubectl:v1.33.1
  - registry.cn-beijing.aliyuncs.com/kubesphereio/redis:7.2.4-alpine
  - registry.cn-beijing.aliyuncs.com/kubesphereio/redis:7.2.8-alpine
  - registry.cn-beijing.aliyuncs.com/kubesphereio/haproxy:3.0.8-alpine
  - registry.cn-beijing.aliyuncs.com/kse/extensions-museum:v11.1.2
  - registry.cn-beijing.aliyuncs.com/kse/ks-console-embed:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kse/ks-posthog:v2.0.0
  # metrics-server
  - docker.io/kubesphere/metrics-server:v0.7.2
  - docker.io/kubesphere/metrics-server-frontend:v1.0.1
  - docker.io/kubesphere/ks-autoscaling-controller:v1.0.0

A clear and concise description of what happend.

制作离线安装包，制作完成后内网安装，使用https://docs.kubesphere.com.cn/v4.2.0/03-installation-and-upgrade/02-install-kubesphere/02-offline-install-kubernetes-and-kubesphere/ 同步镜像到私有镜像仓库，按照教程，报错failed to push images: failed to push image 'm.daocloud.io/docker.io/calico/apiserver:v3.28.2' to remote XXXX: response status code 401: Unauthorized
手动打tag push到镜像仓库是能够成功的

Relevant log output

Additional information

No response

[zuoxuesong-worker]

镜像推送地址变成了 m.daocloud.io/docker.io/xxx/xxx:xxx ？
能麻烦提供一下 inventory_sync_image.yaml 文件吗？

[martin-bian]

@zuoxuesong-worker 感谢回复，和官网教程一样的：

kind: Inventory
metadata:
  name: default
spec:
  vars:
    image_registry:
      auth:
        # 确保您提供的镜像仓库账号密码拥有创建项目和推送镜像的权限
        registry: <您的镜像仓库地址>
        username: <您的镜像仓库账号>
        password: <您的镜像仓库密码>
    localDNS:
     - /etc/hosts

无论是我手动创建harbor还是由kk config文件创建的harbor都一样报错401

[martin-bian]

更新下config.yaml文件：

apiVersion: kubekey.kubesphere.io/v1
kind: Config
spec:
  cni:
    calico_version: v3.28.2
    cilium_version: 1.15.4
    hybridnet_version: 0.6.8
    kubeovn_version: 1.13.0
    multus:
      image:
        tag: v4.3.0
  cri:
    container_manager: containerd
    containerd_version: v1.7.6
    crictl_version: v1.33.0
    cridockerd_version: v0.3.1
    docker_version: 24.0.7
    runc_version: v1.1.7
    sandbox_image:
      tag: "3.9"
  dns:
    dns_cache_image:
      tag: 1.24.0
    dns_image:
      tag: v1.12.1
  etcd:
    etcd_version: v3.5.11
  download:
    arch:
      - amd64
  image_registry:
    docker_registry_version: 2.8.3
    dockercompose_version: v2.20.3
    harbor_version: v2.10.1
    keepalived_version: 2.0.20
    type: harbor
  kubernetes:
    helm_version: v3.18.5
    kube_version: v1.33.3
  storage_class:
    local:
      linux_utils_image:
        tag: 4.2.0
      provisioner_image:
        tag: 4.2.0
    nfs_provisioner_version: 4.3.0
  image_manifests:
  # kubernetes-v1.33.3
  - m.daocloud.io/docker.io/calico/apiserver:v3.28.2
  - m.daocloud.io/docker.io/calico/cni:v3.28.2
  - m.daocloud.io/docker.io/calico/csi:v3.28.2
  - m.daocloud.io/docker.io/calico/kube-controllers:v3.28.2
  - m.daocloud.io/docker.io/calico/node-driver-registrar:v3.28.2
  - m.daocloud.io/docker.io/calico/node:v3.28.2
  - m.daocloud.io/docker.io/calico/pod2daemon-flexvol:v3.28.2
  - m.daocloud.io/docker.io/kubesphere/k8s-dns-node-cache:1.24.0
  - m.daocloud.io/docker.io/openebs/provisioner-localpv:4.2.0
  - m.daocloud.io/docker.io/openebs/linux-utils:4.2.0
  - m.daocloud.io/docker.io/kubesphere/coredns:v1.12.1
  - m.daocloud.io/docker.io/kubesphere/kube-apiserver:v1.33.3
  - m.daocloud.io/docker.io/kubesphere/kube-controller-manager:v1.33.3
  - m.daocloud.io/docker.io/kubesphere/kube-proxy:v1.33.3
  - m.daocloud.io/docker.io/kubesphere/kube-scheduler:v1.33.3
  - m.daocloud.io/docker.io/kubesphere/pause:3.9
  - m.daocloud.io/quay.io/tigera/operator:v1.34.5
  - m.daocloud.io/docker.io/calico/ctl:v3.28.2
  - m.daocloud.io/docker.io/calico/typha:v3.28.2
  - m.daocloud.io/docker.io/library/haproxy:2.9.6-alpine
  # ks-core
  - registry.cn-beijing.aliyuncs.com/kse/ks-apiserver:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kse/ks-console:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kse/ks-controller-manager:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kubesphereio/kubectl:v1.33.1
  - registry.cn-beijing.aliyuncs.com/kubesphereio/redis:7.2.4-alpine
  - registry.cn-beijing.aliyuncs.com/kubesphereio/redis:7.2.8-alpine
  - registry.cn-beijing.aliyuncs.com/kubesphereio/haproxy:3.0.8-alpine
  - registry.cn-beijing.aliyuncs.com/kse/extensions-museum:v11.1.2
  - registry.cn-beijing.aliyuncs.com/kse/ks-console-embed:v4.2.0-20251118
  - registry.cn-beijing.aliyuncs.com/kse/ks-posthog:v2.0.0
  # metrics-server
  - m.daocloud.io/docker.io/kubesphere/metrics-server:v0.7.2
  - m.daocloud.io/docker.io/kubesphere/metrics-server-frontend:v1.0.1
  - m.daocloud.io/docker.io/kubesphere/ks-autoscaling-controller:v1.0.0

[redscholar]

@zuoxuesong-worker 感谢回复，和官网教程一样的：

kind: Inventory
metadata:
name: default
spec:
vars:
image_registry:
auth:
# 确保您提供的镜像仓库账号密码拥有创建项目和推送镜像的权限
registry: <您的镜像仓库地址>
username: <您的镜像仓库账号>
password: <您的镜像仓库密码>
localDNS:
- /etc/hosts
无论是我手动创建harbor还是由kk config文件创建的harbor都一样报错401
@martin-bian 想看看你的registry填的是啥。m.daocloud.io 还是 m.daocloud.io/docker.io

[martin-bian]

kind: Inventory
metadata:
  name: default
spec:
  vars:
    image_registry:
      auth:
        # 确保您提供的镜像仓库账号密码拥有创建项目和推送镜像的权限
        registry: 172.22.18.27
        username: <您的镜像仓库账号>
        password: <您的镜像仓库密码>
    localDNS:
     - /etc/hosts

我使用docker login 登录到上述地址，输入账号密码能够通，通过ca.crt的方式也能通，都能push镜像到私服。

[martin-bian]

Error: task [PushImage | Push images to image registry] (default/artifact-images-679f2-hm5m)run failed:
[localhost]: failed to push image: failed to push image "m.daocloud.io/docker.io/calico/apiserver:v3.28.2" to remote: HEAD "https://172.22.18.27/v2/m.daocloud.io/docker.io/calico/apiserver/manifests/sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" : response status code 401: Unauthoried

上述是错误信息，纯手敲，太折磨了 @redscholar @zuoxuesong-worker

[mumuhhh]

这样写岂不是更好清晰明了 解析来解析去没必要
@redscholar @zuoxuesong-worker

func selectAuth(image string, authList []imageAuth) *imageAuth {
	for i := range authList {
		authRepo := authList[i].Repo
		if strings.HasPrefix(image, authRepo) {
			return &authList[i]
		}
	}
	return nil
}

[56xue]

把kk文件换成4.0.1的版本，就可以离线推镜像了

[zuoxuesong-worker]

Error: task [PushImage | Push images to image registry] (default/artifact-images-679f2-hm5m)run failed: [localhost]: failed to push image: failed to push image "m.daocloud.io/docker.io/calico/apiserver:v3.28.2" to remote: HEAD "https://172.22.18.27/v2/m.daocloud.io/docker.io/calico/apiserver/manifests/sha256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" : response status code 401: Unauthoried

上述是错误信息，纯手敲，太折磨了 @redscholar @zuoxuesong-worker

该问题已经解决了，目前个人harbor测试无误

现在可以使用main分支代码自行构建kk使用