Skaffold "kaniko build failed" in CI

Skaffold's kaniko builder runs the build as a pod in a Kubernetes cluster, so no Docker daemon is needed. It fails when Skaffold cannot reach the build cluster, the kaniko pod lacks a push secret, or the Dockerfile build inside the pod errors.

What this error means

A build fails with "building [my-app]: kaniko build failed" and a pod-side error such as an unauthorized push or a failed RUN inside the kaniko container.

skaffold

building [my-app]: kaniko build failed:
  error checking push permissions -- make sure you entered the correct tag name,
  and that you are authenticated correctly, and try again: UNAUTHORIZED

Common causes

The kaniko pod has no push credentials

kaniko pushes from inside the cluster and needs a registry secret mounted; without it the push is unauthorized.

Skaffold cannot reach the build cluster

The kube-context for the build cluster is missing or wrong in CI, so Skaffold cannot launch the kaniko pod.

How to fix it

Provide a push secret to kaniko

Create a docker registry secret in the build namespace.
Reference it under the cluster build config as the pull/push secret.
Re-run so the kaniko pod can authenticate.

skaffold.yaml

build:
  artifacts:
    - image: my-app
      kaniko: {}
  cluster:
    namespace: build
    pullSecretName: kaniko-registry-secret

Confirm the build cluster context in CI

Make sure KUBECONFIG points at a cluster where kaniko pods can run.

Terminal

kubectl config current-context
skaffold build --default-repo=us-docker.pkg.dev/my-project/my-repo

How to prevent it

Mount a registry push secret for the kaniko pod.
Verify the build cluster context is available in CI.
Keep the build namespace and secret names consistent.