How to configure access to private gitlab registry

[cwrau]

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us what version of Renovate you run.

No response

If you're self-hosting Renovate, select which platform you are using.

None

What is your question?

I've been trying to configure https://github.com/teutonet/teutonet-helm-charts/commits/main/.github/renovate.json to allow access to our private gitlab container registry for the last 3 days or so and I cannot for the life of me figure out why it's not working in the cloud where the password is encrypted, but renovate doesn't complain about vein unable to decrypt it.

Some problems were invalid config even though the validator said everything was ok but now it looks good and it works locally (renovate --platform=local).

It just won't work in the cloud.

Logs (if relevant)

Logs

DEBUG: Adding password authentication for gitlab.teuto.net (hostType=undefined) to hostRules
DEBUG: Adding password authentication for https://registry-gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker (hostType=docker) to hostRules
DEBUG: Failed to look up docker package registry-gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker
{
  "dependency": "registry-gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker"
  "packageFile": "charts/teuto-portal-k8s-worker/values.yaml"
}

In some older jobs renovate tried to get a jwt with the following problems;

Logs

DEBUG: GET https://gitlab.teuto.net/jwt/auth?scope=repository%3A4teuto%2Fdev%2Fteuto-portal%2Fteuto-portal-k8s-worker%2Fteuto-portal-k8s-worker%3Apull&service=container_registry = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=403 retryCount=0, duration=5802)
DEBUG: Not allowed to access docker registry
{
  "registryHost": "https://registry-gitlab.teuto.net"
  "dockerRepository": "4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker"
}

DEBUG: Response code 403 (Forbidden)
{
  "err": {
    "name": "HTTPError",
    "code": "ERR_NON_2XX_3XX_RESPONSE",
    "timings": {
      "start": 1705567994343,
      "socket": 1705567994343,
      "lookup": 1705567994431,
      "connect": 1705567994832,
      "secureConnect": 1705567999932,
      "upload": 1705567999932,
      "response": 1705568000144,
      "end": 1705568000145,
      "phases": {
        "wait": 0,
        "dns": 88,
        "tcp": 401,
        "tls": 5100,
        "request": 0,
        "firstByte": 212,
        "download": 1,
        "total": 5802
      }
    },
    "message": "Response code 403 (Forbidden)",
    "stack": "HTTPError: Response code 403 (Forbidden)\n    at Request.<anonymous> (/opt/containerbase/tools/renovate/37.135.0/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)",
    "options": {
      "headers": {
        "user-agent": "RenovateBot/37.135.0 (https://github.com/renovatebot/renovate)",
        "accept": "application/json",
        "accept-encoding": "gzip, deflate, br"
      },
      "url": "https://gitlab.teuto.net/jwt/auth?scope=repository%3A4teuto%2Fdev%2Fteuto-portal%2Fteuto-portal-k8s-worker%2Fteuto-portal-k8s-worker%3Apull&service=container_registry",
      "hostType": "docker",
      "username": "",
      "password": "",
      "method": "GET",
      "http2": false
    },
    "response": {
      "statusCode": 403,
      "statusMessage": "Forbidden",
      "body": {
        "errors": [
          {
            "code": "DENIED",
            "message": "access forbidden"
          }
        ],
        "http_status": 403
      },
      "headers": {
        "server": "nginx",
        "date": "Thu, 18 Jan 2024 08:53:20 GMT",
        "content-type": "application/json; charset=utf-8",
        "transfer-encoding": "chunked",
        "connection": "close",
        "vary": "Accept-Encoding, Accept",
        "cache-control": "no-cache",
        "content-security-policy": "",
        "page-title": "GitLab",
        "permissions-policy": "interest-cohort=()",
        "x-content-type-options": "nosniff",
        "x-download-options": "noopen",
        "x-frame-options": "SAMEORIGIN",
        "x-gitlab-custom-error": "1",
        "x-gitlab-meta": "{\"correlation_id\":\"01HMDWCNZ9DNDQY2WKCYVYC7R2\",\"version\":\"1\"}",
        "x-permitted-cross-domain-policies": "none",
        "x-request-id": "01HMDWCNZ9DNDQY2WKCYVYC7R2",
        "x-runtime": "0.026708",
        "x-ua-compatible": "IE=edge",
        "x-xss-protection": "1; mode=block",
        "content-encoding": "gzip"
      },
      "httpVersion": "1.1",
      "retryCount": 0
    }
  }
}

DEBUG: Failed to get authHeaders for getTags lookup
DEBUG: Failed to look up docker package registry-gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker
{
  "dependency": "registry-gitlab.teuto.net/4teuto/dev/teuto-portal/teuto-portal-k8s-worker/teuto-portal-k8s-worker"
  "packageFile": "charts/teuto-portal-k8s-worker/values.yaml"
}

[cwrau]

And now it worked once without me changing anything but renovate closed the PR again; teutonet/teutonet-helm-charts#733

[cwrau]

And on my test repo renovate seems to flip between not working and closing and working and reopening the pr?!

cwrau/teutonet-helm-charts#36

[cwrau]

Heyho, anything I can do to get some help for this? 😅

[rarkins]

You need to compare the full debug logs between times it works and when it doesn't work, to see what's different.