GCP Cloud Run Cannot Pull Image from Artifact Registry in Other Project

Question

I have a parent project with a docker-configured artifact registry.

A cloud-based service that runs as part of a child project has to get its image from the parent.

A service account attached to the child project has IAM role roles/artifact registry. writer permission to access the repository.

I receive the following problem when I attempt to launch my service:

To read the image, Google Cloud Run Service Agent has to have permission. 

europe-west1-docker.pkg.dev/test-parent-project/docker-webank-private/node:custom-1. 

Verify that the container image URL provided is accurate and that the aforementioned account has the authorization to access the image. 

It can take a while for the rights to spread if you just enabled the Cloud Run API.

cat $GOOGLE_APPLICATION_CREDENTIALS | docker login -u _json_key --password-stdin https://europe-west1-docker.pkg.dev
> Login succeeded
docker pull europe-west1-docker.pkg.dev/bfb-cicd-inno0/docker-webank-private/node:custom-1
> OK

Answer 1

In Cloud Run, there are two different sorts of service accounts:

The service account for the Google Cloud Run API
The service account for Runtime.
You refer to the runtime service account, the identity that will be used by the service when it runs and calls Google Cloud API, in your description and screenshot.

The service must first be deployed though, before it can run. This time, an internal Google Cloud Run process was launched to pull the container, produce a revision, and do all necessary internal tasks. A service account called "service agent" also exists to carry out that task.

You may locate it in the IAM console at: The structure is as follows

service-@serverless-robot-prod.iam.gserviceaccount.com
Don't forget to select Include in the checkbox in the top right corner.

Give the appropriate access to the deployment service account and not the runtime service account if you want it to be able to pull images from another project.

If you need to know more about Cloud Computing, We recommend joining Cloud Computing Certification today.