GoogleContainerTools/skaffold · error

getting auth config: %w

Error message

getting auth config: %w

What it means

Wraps a failure from a.GetAuthConfig(ctx, configKey) when obtaining credentials for the resolved registry key. Parse succeeded and the official-registry key was determined, but the credential lookup itself failed.

Source

Thrown at pkg/skaffold/docker/auth.go:244

		return DockerIndexName, true
	}
	return val, false
}

func (l *localDaemon) encodedRegistryAuth(ctx context.Context, a AuthConfigHelper, image string) (string, error) {
	ref, err := reference.ParseNormalizedNamed(image)
	if err != nil {
		return "", fmt.Errorf("parsing image name for registry: %w", err)
	}

	configKey, official := parseRepositoryInfo(ref)
	if official {
		configKey = l.officialRegistry(ctx)
	}

	ac, err := a.GetAuthConfig(ctx, configKey)
	if err != nil {
		return "", fmt.Errorf("getting auth config: %w", err)
	}

	return encodeAuthConfig(ac)
}

func encodeAuthConfig(authConfig types.AuthConfig) (string, error) {
	b, err := json.Marshal(authConfig)
	if err != nil {
		return "", err
	}
	return base64.URLEncoding.EncodeToString(b), nil
}

func (l *localDaemon) officialRegistry(ctx context.Context) string {
	serverAddress := "https://index.docker.io/v1/"

	// The daemon `/info` endpoint informs us of the default registry being used.
	info, err := l.apiClient.Info(ctx, client.InfoOptions{})

View on GitHub (pinned to a1189de023)

Solutions

1. Fix or reinstall the credential helper (e.g. `gcloud components update`; re-login docker)
2. Run `docker login <registry>` to populate credentials
3. Inspect the wrapped inner error to identify which helper/store failed
4. Check ~/.docker/config.json credsStore/credHelpers entries are valid

Example fix

// before
~/.docker/config.json credHelpers -> gcr.io: "gcr-auth-helper" (missing binary)
// after
gcloud components install docker-credential-gcr
docker-credential-gcr configure-docker
# or simply: docker login gcr.io

cf, err := config.Load(configDir)
if err != nil { return err }
for reg, h := range cf.CredentialHelpers {
  if _, err := exec.LookPath(h); err != nil {
    return fmt.Errorf("cred helper %s for %s missing", h, reg)
  }
}

err := daemon.Push(ctx, image)
if err != nil && strings.Contains(err.Error(), "getting auth config") {
  return fmt.Errorf("registry auth failed; run `docker login <registry>` or fix cred helper: %w", err)
}

When it happens

Trigger: encodedRegistryAuth calls GetAuthConfig; loadDockerConfig fails (bad docker config), the credential helper/credsStore errors, or no credentials can be resolved for the registry key.

Common situations: Broken credential helper binary (gcloud cred helper outdated); credsStore backend (e.g. desktop/keychain) unavailable; registry requires auth and none configured; expired credentials.

Related errors

• pulling image from repository: %w
• %s %q: %w
• docker config: %w
• error getting google authenticator
• parsing image name for registry: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/0ffe86a2fcaf65f9. Report an issue: GitHub.