How to use an image from container registry in different project?

8/26/2015

I have two projects in Google Cloud. On the first project I have some images in the container registry and i'm using it in the gke.

When I trie to create a container in the second project, it gives me a error:

Error: Status 403 trying to pull repository project-1/image-x: "Access denied."

How can i use those images in the gke but in different project? I don't want to create the same images in the second project.

-- lucas.coelho
google-container-registry
google-kubernetes-engine

3 Answers

8/7/2017

In your second project (the GKE project), look at the IAM permissions and you will see a user similar to: 123456789-compute@developer.gserviceaccount.com.

Then in your first project (the container registry project), grant that user the Storage Object Viewer permission to allow GKE to pull images.

-- AllSySt3msG0
Source: StackOverflow

8/26/2015

You can modify who the images are visible to by using the access control settings available on the Google Cloud Storage bucket that they're stored in.

Reference: https://cloud.google.com/container-registry/docs/access-control

If you just want to make all your images readable to the entire world, then the command from this other StackOverflow answer should help: gsutil -m acl -r set public-read gs://bucket-name gsutil -m defacl set public-read gs://bucket-name

-- Alex Robinson
Source: StackOverflow

8/27/2015

This is discussed in detail in my answer here: Access google container registry without the gcloud client

If you cannot get things working, also feel free to reach out to us at gcr-contact@google.com, and we'd be happy to help.

-- mattmoor
Source: StackOverflow