Is it possible track the number of docker pulls in Google Artifact Registry?

user_495995 0
Viewed 176

I'd like to measure the number of times a Docker image has been downloaded from a Google Artifact registry repository in my GCP project.

Is this possible?

google-artifact-registry gcloud google-cloud-platform
1 Answers

Interesting question.

I think this would be useful too.

I think there aren't any Monitoring metrics (no artifactregistry resource type is listed nor metrics are listed)

However, you can use Artifact Registry audit logs and you'll need to explicitly enable Data Access logs see e.g. Docker-GetManifest.

enter image description here

NOTE I'm unsure whether this can be achieved from gcloud.

Monitoring Developer tools, I learned that Audit Logs are configured in Project Policies using AuditConfig's. I still don't know whether this functionality is available through gcloud (anyone?) but evidently, you can effect these changes directly using API calls e.g. projects.setIamPolicy:

gcloud projects get-iam-policy ${PROJECT}
auditConfigs:
- auditLogConfigs:
  - logType: DATA_READ
  - logType: DATA_WRITE
  service: artifactregistry.googleapis.com
bindings:
- members:
  - user:me
  role: roles/owner
etag: BwXanQS_YWg=

Then, pull something from the repo and query the logs:

PROJECT=[[YOUR-PROJECT]]
REGION=[[YOUR-REGION]]
REPO=[[YOUR-REPO]]

FILTER="
logName=\"projects/${PROJECT}/logs/cloudaudit.googleapis.com%2Fdata_access\"
protoPayload.methodName=\"Docker-GetManifest\"
"

gcloud logging read "${FILTER}" \
--project=${PROJECT} \
--format="value(timestamp,protoPayload.methodName)"

Yields:

2022-03-20T01:57:16.537400441Z  Docker-GetManifest

You ought to be able to create a logs-based metrics for these too.

user_6092900
Related