如何在不同项目中使用容器注册表中的图像？

Question

I have two projects in Google Cloud. On the first project I have some images in the container registry and i'm using it in the gke.

When I trie to create a container in the second project, it gives me a error:

Error: Status 403 trying to pull repository project-1/image-x: "Access denied."

How can i use those images in the gke but in different project? I don't want to create the same images in the second project.

Answer 1

You can modify who the images are visible to by using the access control settings available on the Google Cloud Storage bucket that they're stored in.

Reference: https://cloud.google.com/container-registry/docs/access-control

If you just want to make all your images readable to the entire world, then the command from this other StackOverflow answer should help: gsutil -m acl -r set public-read gs://bucket-name gsutil -m defacl set public-read gs://bucket-name

Answer 2

This is discussed in detail in my answer here: Access google container registry without the gcloud client

If you cannot get things working, also feel free to reach out to us at gcr-contact@google.com, and we'd be happy to help.

Answer 3

In your second project (the GKE project), look at the IAM permissions and you will see a user similar to: 123456789-compute@developer.gserviceaccount.com .

Then in your first project (the container registry project), grant that user the Storage Object Viewer permission to allow GKE to pull images.

Answer 4

I hope this article will helpful Using Images from Other Projects