GCP Cloud Run Cannot Pull Image from Artifact Registry in Other Project

user_2599657 0
Viewed 1583

I have a parent project that has an artifact registry configured for docker.

A child project has a cloud run service that needs to pull its image from the parent.

The child project also has a service account that is authorized to access the repository via an IAM role roles/artifactregistry.writer.

When I try to start my service I get an error message:

Google Cloud Run Service Agent must have permission to read the image, europe-west1-docker.pkg.dev/test-parent-project/docker-webank-private/node:custom-1. Ensure that the provided container image URL is correct and that the above account has permission to access the image. If you just enabled the Cloud Run API, the permissions might take a few minutes to propagate. Note that the image is from project [test-parent-project], which is not the same as this project [test-child-project]. Permission must be granted to the Google Cloud Run Service Agent from this project.

I have tested manually connecting with docker login and using the service account's private key and the docker pull command works perfectly from my PC.

cat $GOOGLE_APPLICATION_CREDENTIALS | docker login -u _json_key --password-stdin https://europe-west1-docker.pkg.dev
> Login succeeded
docker pull europe-west1-docker.pkg.dev/bfb-cicd-inno0/docker-webank-private/node:custom-1
> OK

The service account is also attached to the cloud run service:

enter image description here

google-cloud-run gcloud docker
1 Answers

You have 2 types of service account used in Cloud Run:

  • The Google Cloud Run API service account
  • The Runtime service account.

In your explanation, and your screenshot, you talk about the runtime service account, the identity that will be used by the service when it runs and call Google Cloud API.

BUT before running, the service must be deployed. This time, it's a Google Cloud Run internal process that run to pull the container, create a revision and do all the required internal stuff. To do that job, a service account also exist, it's named "service agent".

In the IAM console, you can find it: the format is the following

service-<PROJECT_NUMBER>@serverless-robot-prod.iam.gserviceaccount.com

Don't forget to tick the checkbox in the upper right corner to include the Google Managed service account enter image description here

If you want that this deployment service account be able to pull image in another project, grant on it the correct permission, not on the runtime service account.

user_113725930
Related