GoogleContainerTools/jib · warning

InferredAuthException

Error message

InferredAuthException: ${message}

What it means

This is not a thrown exception but a logged warning: while configuring credential retrievers, Jib attempted to use inferred authentication (e.g. from a plugin/provider like the Docker config or extension-supplied auth) and the InferredAuthException raised during that lookup was caught, logged at WARN level, and the build continues without the inferred credential.

Solutions

1. Read the wrapped message in the warning and fix the underlying auth source (e.g. re-run docker login or cloud provider login)
2. Verify username/password are present in the auth entry being inferred
3. Configure an explicit credential helper or username/password in the Jib configuration instead of relying on inferred auth
4. Ignore if another credential retriever (helper, explicit creds) succeeds

Example fix

// before
<gcp.projectId>...</gcp.projectId>  // relying on stale inferred gcloud auth
// after
<configuration>
  <from><image>...</image></from>
  <to><image>...</image></to>
</configuration>
# and refresh credentials:
gcloud auth login && gcloud auth configure-docker

// Check that inferred auth entries contain both username and password
Object auth = dockerConfigJson.getAuth();
if (auth == null || auth.getUsername() == null || auth.getPassword() == null) {
  logger.warn("Inferred auth incomplete; configure a credential helper explicitly");
}

try {
  configureInferredAuth();
} catch (InferredAuthException e) {
  logger.warn("Skipping inferred auth: " + e.getMessage());
}

When it happens

Trigger: PluginConfigurationProcessor.configureCredentialRetrievers calls code that may throw InferredAuthException while extracting username/password from inferred auth (e.g. helpers like 'gcloud' credential extension data); on exception it logs "InferredAuthException: <message>" and proceeds with the remaining credential retrievers.

Common situations: Stale or incomplete docker/config.json auth entries (e.g. auths with missing username/password); expired cloud-provider credentials; malformed auth blocks produced by `docker login` variants.

Related errors

• Caused by
• All layers in the manifest template must have digest set
• Authentication over HTTP is enabled. It is strongly…
• Base image ' ' does not use a specific image digest - build…
• Blob not available for digest-only layer

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/6e01d42bbf4951ea. Report an issue: GitHub.

Appendix: source

Thrown at jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/PluginConfigurationProcessor.java:1015

            passwordPropertyName,
            rawAuthConfiguration,
            rawConfiguration);
    if (optionalCredential.isPresent()) {
      defaultCredentialRetrievers.setKnownCredential(
          optionalCredential.get(), rawAuthConfiguration.getAuthDescriptor());
    } else {
      try {
        Optional<AuthProperty> optionalInferredAuth =
            inferredAuthProvider.inferAuth(imageReference.getRegistry());
        if (optionalInferredAuth.isPresent()) {
          AuthProperty auth = optionalInferredAuth.get();
          String username = Verify.verifyNotNull(auth.getUsername());
          String password = Verify.verifyNotNull(auth.getPassword());
          Credential credential = Credential.from(username, password);
          defaultCredentialRetrievers.setInferredCredential(credential, auth.getAuthDescriptor());
        }
      } catch (InferredAuthException ex) {
        projectProperties.log(LogEvent.warn("InferredAuthException: " + ex.getMessage()));
      }
    }

    defaultCredentialRetrievers.setCredentialHelper(
        credHelperConfiguration.getHelperName().orElse(null));
    defaultCredentialRetrievers.asList().forEach(registryImage::addCredentialRetriever);
  }

  private static ImageReference getGeneratedTargetDockerTag(
      RawConfiguration rawConfiguration,
      ProjectProperties projectProperties,
      HelpfulSuggestions helpfulSuggestions)
      throws InvalidImageReferenceException {
    return ConfigurationPropertyValidator.getGeneratedTargetDockerTag(
        rawConfiguration.getToImage().orElse(null), projectProperties, helpfulSuggestions);
  }

  /**

View on GitHub (pinned to fb949e2676)