服务帐户无法将 Docker 图像推送到 Google Artifact Registry

Question

I am trying to push a Docker image to Google Artifact Registry (GAR) while impersonating a Service Account ( $SERV_ACCT_EMAIL ):

denied: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/$GCP_PROJECT_ID/locations/us-west1/repositories/$GAR_REPOSITORY" (or it may not exist)

$SERV_ACCT_EMAIL has Artifact Registry Writer ( roles/artifactregistry.writer ) and Artifact Registry Reader ( roles/artifactregistry.reader ) roles; the latter of which has the permission artifactregistry.repositories.downloadArtifacts . Thus, if the resource is granted access to $SERV_ACCT_EMAIL , I believe I will indeed be able to push those artifacts.

How do I push to GAR while impersonating $SERV_ACCT_EMAIL ?

Answer 1

You may need to configure-docker while impersonating your service account ( $SERVICE_ACCOUNT_EMAIL ):

1. Check to make sure you are still impersonating $SERVICE_ACCOUNT_EMAIL :

    gcloud auth list #=> Credentialed Accounts ACTIVE ACCOUNT. . . * $SERVICE_ACCOUNT_EMAIL. . .

   if not:

    gcloud auth activate-service-account \ "$SERVICE_ACCOUNT_EMAIL" \ --key-file=$SERVICE_ACCOUNT_JSON_FILE_PATH #=> Activated service account credentials for: [$SERVICE_ACCOUNT_EMAIL]

2. Run the configure-docker command against the auth group:

    gcloud auth configure-docker us-west1-docker.pkg.dev #=>. . . Adding credentials for: us-west1-docker.pkg.dev. . .

3. Finally, try push ing the Docker image again.