gitlab-ci-token account cannot push to registry using anything but the default image name / level.

Summary

Trying to have a pipeline publish 2 docker images. One to the so called default registry image name which works fine. Another using the levels supported here using the 2nd example of registry.example.com/group/project/image:latest.

This works fine when performing by hand using my account (which is a gitlab admin) but fails when using the gitlab-ci-token account.

Steps to reproduce

Docker push using the gitlab-ci-token to registry.example.com/group/project/image:latest

What is the current bug behavior?

Permission Denied

What is the expected correct behavior?

Permission granted

Results of GitLab environment info

Expand for output related to GitLab environment info

System information System: Scientific 6.10 Current User: git Using RVM: no Ruby Version: 2.6.3p62 Gem Version: 2.7.9 Bundler Version:1.17.3 Rake Version: 12.3.2 Redis Version: 3.2.12 Git Version: 2.22.0 Sidekiq Version:5.2.7 Go Version: unknown GitLab information Version: 12.2.1 Revision: fa2d61ef521 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 10.9 URL: https://gitlab.symbria.com HTTP Clone URL: https://gitlab.symbria.com/some-group/some-project.git SSH Clone URL: git@gitlab.symbria.com:some-group/some-project.git Using LDAP: yes Using Omniauth: yes Omniauth Providers:

GitLab Shell Version: 9.3.0 Repository storage paths:

default: /home/gitlab/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git

Results of GitLab application Check

Expand for output related to the GitLab application check

Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version >= 9.3.0 ? ... OK (9.3.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Check GitLab API access: OK Redis available via internal API: OK

Access to /var/opt/gitlab/.ssh/authorized_keys: OK gitlab-shell self-check successful

Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK

Checking Gitaly ... Finished
Checking Sidekiq ...

Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished
Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished
Checking LDAP ...

LDAP: ... Server: ldapmain LDAP authentication... Anonymous. No bind_dn or password configured LDAP users with access to your GitLab server (only showing the first 100 results) User output sanitized. Found 100 users of 100 limit.

Checking LDAP ... Finished
Checking GitLab App ...

Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... no Try fixing it: sudo chown -R git /var/opt/gitlab/gitlab-rails/uploads sudo find /var/opt/gitlab/gitlab-rails/uploads -type f -exec chmod 0644 {} ; sudo find /var/opt/gitlab/gitlab-rails/uploads -type d -not -path /var/opt/gitlab/gitlab-rails/uploads -exec chmod 0700 {} ; For more information see: doc/install/installation.md in section "GitLab" Please fix the error above and rerun the checks. Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 5/1 ... yes 5/2 ... yes 1/4 ... yes 4/5 ... yes 6/6 ... yes 6/7 ... yes 2/9 ... yes 2/10 ... yes 2/11 ... yes 2/12 ... yes 2/14 ... yes 2/15 ... yes 2/16 ... yes 2/17 ... yes 7/18 ... yes 8/19 ... yes 8/20 ... yes 8/21 ... yes 9/22 ... yes 9/23 ... yes 10/24 ... yes 11/25 ... yes 11/26 ... yes 12/27 ... yes 13/28 ... yes 13/29 ... yes 13/30 ... yes 13/31 ... yes 13/32 ... yes 13/33 ... yes 13/34 ... yes 13/35 ... yes 13/36 ... yes 13/37 ... yes 13/38 ... yes 13/39 ... yes 13/40 ... yes 13/41 ... yes 13/42 ... yes 13/43 ... yes 13/44 ... yes 13/45 ... yes 13/46 ... yes 13/47 ... yes 13/48 ... yes 13/49 ... yes 13/50 ... yes 13/51 ... yes 13/52 ... yes 13/53 ... yes 13/54 ... yes 13/55 ... yes 13/56 ... yes 14/57 ... yes 15/58 ... yes 15/59 ... yes 16/60 ... yes 27/62 ... yes 4/63 ... yes 19/64 ... yes 13/65 ... yes 10/66 ... yes 30/67 ... yes 13/68 ... yes 10/69 ... yes 16/70 ... yes 13/71 ... yes 33/72 ... yes 33/73 ... yes 33/74 ... yes 19/75 ... yes 34/76 ... yes 18/78 ... yes 36/79 ... yes 36/81 ... yes 2/82 ... yes 37/86 ... yes 34/87 ... yes 34/88 ... yes 34/90 ... yes 11/91 ... yes 11/92 ... yes 11/93 ... yes 11/94 ... yes 11/95 ... yes 11/96 ... yes 11/97 ... yes 34/98 ... yes 34/99 ... yes 34/100 ... yes 34/102 ... yes 34/103 ... yes 34/104 ... yes 34/106 ... yes 34/107 ... yes 34/108 ... yes 34/109 ... yes 34/110 ... yes 34/111 ... yes 34/113 ... yes 38/114 ... yes 34/115 ... yes 34/116 ... yes 34/117 ... yes 38/118 ... yes 34/119 ... yes 11/122 ... yes 34/123 ... yes 34/124 ... yes 34/125 ... yes 11/126 ... yes 37/127 ... yes 34/128 ... yes 34/129 ... yes 11/130 ... yes 11/131 ... yes 34/132 ... yes 34/133 ... yes 11/134 ... yes 34/136 ... yes 34/137 ... yes 34/138 ... yes 34/139 ... yes 34/140 ... yes 11/141 ... yes 11/142 ... yes 38/143 ... yes 27/144 ... yes 39/145 ... yes 33/146 ... yes 2/147 ... yes 44/148 ... yes 14/149 ... yes 33/150 ... yes 33/151 ... yes 45/152 ... yes 46/155 ... yes 2/157 ... yes 38/158 ... yes 13/159 ... yes 11/160 ... yes 11/161 ... yes 11/162 ... yes 33/163 ... yes 38/164 ... yes 38/167 ... yes 18/168 ... yes 4/169 ... yes 4/170 ... yes 19/171 ... yes 16/172 ... yes 38/174 ... yes 18/175 ... yes 2/176 ... yes 18/177 ... yes 38/178 ... yes 17/179 ... yes 38/180 ... yes 2/181 ... yes 23/182 ... yes 19/183 ... yes 38/184 ... yes 38/185 ... yes 51/186 ... yes 38/187 ... yes 38/188 ... yes 52/189 ... yes 13/191 ... yes 52/192 ... yes 13/193 ... yes 2/201 ... yes 4/206 ... yes 53/207 ... yes 2/208 ... yes 11/209 ... yes 4/210 ... yes 23/211 ... yes 19/212 ... yes 54/214 ... yes 11/216 ... yes 27/217 ... yes 47/218 ... yes 11/219 ... yes 14/220 ... yes 47/221 ... yes 47/222 ... yes 52/223 ... yes 46/224 ... yes 47/225 ... yes 47/226 ... yes 2/227 ... yes 14/228 ... yes 52/229 ... yes 2/230 ... yes 2/232 ... yes 2/233 ... yes 38/234 ... yes 37/235 ... yes 58/236 ... yes 58/237 ... yes 58/238 ... yes 59/239 ... yes 13/240 ... yes 2/241 ... yes 62/242 ... yes 11/243 ... yes 11/244 ... yes 58/245 ... yes 58/246 ... yes 65/247 ... yes 11/248 ... yes 11/249 ... yes 44/250 ... yes 44/251 ... yes 38/252 ... yes 66/253 ... yes 38/254 ... yes 15/255 ... yes 37/257 ... yes 65/258 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.5.3 ? ... yes (2.6.3) Git version >= 2.22.0 ? ... yes (2.22.0) Git user has default SSH configuration? ... yes Active users: ... 20
Checking GitLab App ... Finished

Checking GitLab subtasks ... Finished