[Server] Helm login results in unauthorized: authentication required error

Overview

If a previously working helm registry login command against the CircleCI Server image registry starts returning an unauthorized: authentication required error, there are two common causes: incorrect credentials, or expired registry credentials tied to your CircleCI Server license.

Steps to Resolve

1. Verify your credentials are correct. Confirm that the $USERNAME and $PASSWORD values being passed are accurate. These are provided by CircleCI as part of your Server onboarding or license renewal.

2. Check your license status. If your credentials were previously working, the most likely cause is an expired license. Contact your CircleCI account team to confirm your license status and obtain renewed credentials.

3. Update your registry credentials and redeploy. Once you have new credentials, update the Kubernetes image pull secret in your cluster and redeploy via Helm. There is no expected downtime for this operation.

   Update the image pull secret:

   kubectl -n <namespace> create secret docker-registry regcred   --docker-server=cciserver.azurecr.io   --docker-username=<your-username>   --docker-password="<new-token>"   --docker-email=<your-contact-email>   --save-config --dry-run=client -o yaml | kubectl apply -f -

   Then update your values.yaml with the new credentials and run:

   helm upgrade circleci-server oci://cciserver.azurecr.io/circleci-server   -n $namespace   --version <current-version>   -f <path-to-values.yaml>   --username $USERNAME   --password $PASSWORD

Additional Resources

• CircleCI Server core services installation: registry credentials
• Updating a Server 4.x environment with a new license
• Upgrading CircleCI Server