`pack builder create` cannot authenticate against Azure Container Registry (ACR) about pack HOT 4 OPEN

Okay, here is an update. When I login with az acr login -n private-registry instead of logging in directly using a service principal, it worked properly. The ~/.docker/config.json now looks like this

{
        "auths": {
                "private-registry.azurecr.io": {
                        "auth": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwOg==",
                        "identitytoken": "<redacted>"
                }
        }
}

It seems a credential helper was used, but I don't see it specified in this file.

from pack.

@tgquan67 could this be the same as #2064 in that client certs are needed (though the pack command is different)?

It's worth noting, the pack client constructs its keychain here - since pack is optimized for local development, we assume the default keychain is sufficient but perhaps we need something more like the lifecycle keychain which can make use of IaaS credential helpers.

from pack.

@natalieparellano no, these 2 problems are not related, since for normal daily usage, the registry on ACR doesn't require any client certificate.
Edit: it seems you misunderstood my case in both ticket. The cert here is for the server to verify client's identity, not the root cert in case the server is self-signed.

from pack.

since for normal daily usage, the registry on ACR doesn't require any client certificate.

In that case, I suspect the problem is with the default keychain not having the right credentials

perhaps we need something more like the lifecycle keychain which can make use of IaaS credential helpers.

I could be wrong, but maybe this is what we need. Do you have any opinion here?

from pack.