I'd like to configure our company container registry on GCP to:
The goal is to avoid using latest tag - or any other mutable tag - and consistently use new, immutable tags for new images.
Is there a set of IAM roles or permissions that can achieve this behaviour?
You don't have to use IAM roles. It should be Service Account. You need to create a service account, set GCR Editor role for it, download JSON file then send it to your staffs.
A service account JSON key file is a long-lived credential that is scoped to a specific GCP Console project and its resources.
The service account you use to push and pull images must be correctly configured with the required permissions and access scope for interaction with Container Registry.
Service accounts automatically created by GCP, such as the Container Registry service account, are granted the read-write Editor role for the parent project. The Compute Engine default service account is configured with read-only access to storage within the same project. You may wish to grant other service accounts more specific permissions. Pushing and pulling images across projects requires proper configuration of both permissions and access scopes on the service account that interacts with Container Registry.
For more information about the required service account permissions and scopes to push and pull images, refer to the requirements for using Container Registry with Google Cloud Platform.
