CODEWITHSUNDEEP
dockergcloudgoogle-cloud-buildgoogle-cloud-iamgoogle-artifact-registry
jose fernandez
jose fernandez

Reputation: 41

Why Can't I Pull Google Artifact Registry Docker Images Build with Google Cloud Build?

I created a Docker image ($DOCKER_IMAGE_NAME) using Google Cloud Build (GCB). I don't seem to be able to pull $DOCKER_IMAGE_NAME:

docker pull us-central1-docker.pkg.dev/. . ./$DOCKER_IMAGE_NAME:$DOCKER_IMAGE_TAG

#=>

Error response from daemon: Get https://us-central1-docker.pkg.dev/. . ./$DOCKER_IMAGE_NAME/v1: denied: Permission "artifactregistry.repositories.downloadArtifacts"denied on resource "projects/. . ./$DOCKER_REPOSITORY_NAME" (or it may not exist)

How can I pull $DOCKER_IMAGE_NAME?

Upvotes: 2

Views: 4230

Answers (3)

PCatinean
PCatinean

Reputation: 106

I saw the setup instructions from artifact registry at a later time (migrated from container registry) and it's needd to specify the region gcloud auth configure-docker europe-west1-docker.pkg.dev

Upvotes: 1

Devang Pandya
Devang Pandya

Reputation: 1

You also need to add role related to Artifact to your service account. Even if your service account has a owner role it wont work because GCP artifact repo has its own permissions boundary.

Upvotes: 0

Gerb
Gerb

Reputation: 496

The error message seems to indicate that you need to grant permissions.

You will need to run the add-iam-policy-binding command:

gcloud projects add-iam-policy-binding $PROJECT \
--member=$MEMBER \
--role=$ROLE

where $ROLE is artifactregistry.repositories.downloadArtifacts.

See this for more information.

Upvotes: 4

Related Questions