Cloudbuild can't access Artifacts Registery when building cloud run docker container

user_649762 0
Viewed 441

I'm using a package from Artifacts Registery in my cloud run nodejs container. When I try to gcloud builds submit I get the following error:

Step #1: npm ERR! 403 403 Forbidden - GET https://us-east4-npm.pkg.dev/....
Step #1: npm ERR! 403 In most cases, you or one of your dependencies are requesting
Step #1: npm ERR! 403 a package version that is forbidden by your security policy.

Here is my cloudbuild.yaml:

steps:
 - name: gcr.io/cloud-builders/npm
   args: ['run', 'artifactregistry-login']

 - name: 'gcr.io/cloud-builders/docker'
   args: ['build', '-t', 'gcr.io/...', '.']
 
 - name: 'gcr.io/cloud-builders/docker'
   args: ['push', 'gcr.io/...']
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
   entrypoint: gcloud
   args:
   - 'run'
   - 'deploy'
   - 'admin-api'
   - '--image'
   - 'gcr.io/...'
   - '--region'
   - 'us-east4'
   - '--allow-unauthenticated'
images:
 - 'gcr.io/....'

and Dockerfile

FROM node:14-slim

WORKDIR /usr/src/app

COPY --chown=node:node .npmrc ./

COPY package*.json ./


RUN npm install

COPY . ./

EXPOSE 8080

CMD [ "npm","run" ,"server" ]

.npmrc file:

@scope_xxx:registry=https://us-east4-npm.pkg.dev/project_xxx/repo_xxx/
//us-east4-npm.pkg.dev/project_xxx/repo_xxx/:always-auth=true

the google build service account already has the permission "Artifact Registry Reader"

cloudbuild.yaml google-artifact-registry google-cloud-build google-cloud-run gcloud
3 Answers

You have to connect the CloudBuild network in your docker build command. Like that

 - name: 'gcr.io/cloud-builders/docker'
   args: ['build', '-t', 'gcr.io/...', '--network=cloudbuild', '.']
user_113725930

I had the same root cause, my setup is close to @AmmAr, after hours of trial and error, found a solution.

Dislaimer, this might not be the reason for your issue, the gcp 403 error message is vague, you need to chip away and eliminate all possibilities, that is how I arrived on this page.

Comparing to @AmmArr above, the changes I made:-

  • In node.js package.json, add to "scripts" :{...} property

     "artifactregistry-login": "npx google-artifactregistry-auth",
 "artifactregistry-auth-npmrc": "npx google-artifactregistry-auth .npmrc"

  • In cloudbuild.yaml, I added two steps prior to the build step, these steps should result in .npmrc getting appended with an access token, allowing it to communicate with the gcp artifact repository, thus that should resolve the 403 issue for this scenario.

steps:
  - name: gcr.io/cloud-builders/npm
    args: ['run', 'artifactregistry-login']
  - name: gcr.io/cloud-builders/npm
    args: ['run', 'artifactregistry-auth-npmrc']
  - name: gcr.io/cloud-builders/docker
    args: ['build', '-t', 'gcr.io/...', '.']
 #- next steps in your process...

  • In Dockerfile, copy over .nmprc before package.json

      COPY .npmrc ./

  COPY package*.json ./

  • Finally, screenshot of my cloud build config enter image description here

  • Now run, and see if it gets past the build step where it pulls npm module from artifact registry.
user_35247620
user_6497620
Related