3

How can a GKE cluster pull container images from a Container Registry hosted in another project?

I have a GKE cluster in project <reader-project> trying to access a GCR image in project <registry-project>.

I've tried adding the GCE service account email for <reader-project> as a User with Reader access on the storage bucket in <registry-project>, but I'm still getting the error:

<Error><Code>AccessDenied</Code>
<Message>Access denied.</Message>
<Details>Caller does not have storage.objects.get access to object us.artifacts.<registry-project>.appspot.com/containers/images/sha256:<tag>.
</Details></Error>
Symmetric
  • 4,495
  • 5
  • 32
  • 50

3 Answers3

5

Try to add GCE service account email as a User with Storage Object Viewer role. It gives the service account Read-Only access to GCS objects(container images) in your project.

Lizhu Qi
  • 197
  • 1
  • 5
  • Is it possible to add a bunch of project service account emails under one IAM role so that I can grant other permissions to that group as well? Looks like it should be, but I already tried that approach for Storage Viewer and it didn't work. – Symmetric Jul 27 '16 at 19:55
  • yeah, that should be fine. – Lizhu Qi Jul 27 '16 at 20:34
  • This does not work now. I tried by adding the compute engine service account of different project to the project containing registry. I still get 403 error. – Lakshman Diwaakar Jan 24 '17 at 02:46
1

Look at the IAM permissions of the project under which you have your GKE and you will see a user similar to: 123456789-compute@developer.gserviceaccount.com.

Then in your container registry project, grant that user the Storage Object Viewer permission. Your GKE will then be allowed to pull images from th

AllSySt3msG0
  • 133
  • 1
  • 7
0

Can you run the following commands to check the permissions for both buckets:

gsutil acl get gs://us.artifacts..appspot.com

gsutil acl get gs://artifacts..appspot.com

artifacts..appspot.com is the default bucket. When you add the service account as Storage Object Viewer, read-only permission of the default bucket is granted.

Here is the link about gsutil tool: https://cloud.google.com/storage/docs/gsutil/commands/acl

Lizhu Qi
  • 197
  • 1
  • 5