Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: docker now provides a new favorite way to store the credentials with the variable credsStore in the file it it is set to desktop, which will be using the executable docker-credential-desktop whose source code is docker-credential-desktop doesn't pad the auth field. So, if we use the command k8s credential provider won't be able to decode the field because of the error Failed to pull image "myrepo/myimage:tag": illegal base64 data at input byte What you expected to happen: Image pulled normally How to reproduce it (as minimally and precisely as possible): open docker config file, and have credsStore set to desktop. Run docker login and then use the to create a k8s dockerconfigjson secret, the error will directly show Anything else we need to know?: I wrote a patch that I will submit Environment: Kubernetes version (use ): Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.3", GitCommit:"", GitTreeState:"clean", BuildDate:"2019-08-19T12:38:36Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"darwin/amd64"} Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.2", GitCommit:"", GitTreeState:"clean", BuildDate:"2019-08-05T09:15:22Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64" Cloud provider or hardware configuration: minikube version: v1.3.1 commit: OS (e.g: ): Mac Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig Apps
/remove-sig apps /sig auth /sig node cc to triage

Discussion:
// decodeDockerConfigFieldAuth deserializes the "auth" field from dockercfg into a // username and a password. The format of the auth field is base64(<username>:<password>). func decodeDockerConfigFieldAuth(field string) (username, password string, err error) { <del> decoded, err := base64.StdEncoding.DecodeString(field) </del> <ins> var decoded []byte // StdEncoding can only decode padded string // RawStdEncoding can only decode unpadded string // a string is correctly padded if and only if its length is a multiple of 4 if (len(field) % 4) == 0 { // decode padded data decoded, err = base64.StdEncoding.DecodeString(field) } else { // decode unpadded data decoded, err = base64.RawStdEncoding.DecodeString(field) } </ins> if err != nil { return }

package credentialprovider import ( <ins> "encoding/base64" </ins> "encoding/json" "io/ioutil" "os"

password: "bar", }, <ins> // some test as before but with field not well padded { input:    "Zm9vOmJhcg", username: "foo", password: "bar", }, // standard encoding (with padding) { input:    base64.StdEncoding.EncodeToString([]byte("foo:bar")), username: "foo", password: "bar", }, // raw encoding (without padding) { input:    base64.RawStdEncoding.EncodeToString([]byte("foo:bar")), username: "foo", password: "bar", }, // the input is encoded with encodeDockerConfigFieldAuth (standard encoding) { input:    encodeDockerConfigFieldAuth("foo", "bar"), username: "foo", password: "bar", }, </ins> // good base64 data, but no colon separating username & password { input: "cGFudHM=",