bitbucket pipeline to use image from Goocle artifact registry

[Sriram Ramanujam]

Hi Guys, 

I am trying to develop a pipeline which would use image from Google Artifact registry

definitions:

steps:

- step: &base-img

oidc: true

image:

name: northamerica-northeast1-docker.pkg.dev/ps-np-dev-gke-def1/gcp-iac-pipeline/gcp-iac-pipeline:1.0.0

script:

- gcloud auth configure-docker northamerica-northeast1-docker.pkg.dev

- export SERVICE_ACCOUNT_EMAIL="${GCP_SERVICE_ACCOUNT}"

- ./get_oidctoken.sh

- export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json

- step: &self-hosted

runs-on:

- 'self.hosted'

- 'gke.k8s'

- 'autoscaler.created'

- 'linux'

and I have the following error 
Unable to pull image: Head \"https://northamerica-northeast1-docker.pkg.dev/v2/xxxxxxx/image/gcp-iac-pipeline/manifests/1.0.0\": denied: Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" on resource \"projects/xxxxxxx/locations/northamerica-northeast1/repositories/gcp-iac-pipeline\" (or it may not exist)

has anyone faced this.. 
i see other post related to GCR but that is not helpful here 

[Theodora Boudale]

Hi Sriram and welcome to the community!

If you want to use a private docker image from Google Artifact Registry as a build container, please see the instructions in our documentation on how to use a JSON key for authentication:

• https://support.atlassian.com/bitbucket-cloud/docs/use-docker-images-as-build-environments/#Private-images-hosted-by-Google-Container-Registry--GCR-

The documentation mentions Google Container Registry, however it applies to Google Artifact Registry as well if the service account has permissions to access the artifact registery.

Kind regards,
Theodora

[Sriram Ramanujam]

@Theodora Boudale the link you shared covers GCR. 

but I have my images in Google Artifact registry. this solution is not helping me and I have tried it. 

[Sriram Ramanujam]

@Theodora Boudale  let me know any other sample pipeline which covers Artifact registry. 

[Theodora Boudale]

Hi Sriram,

The link I shared mentions GCR, but it applies to Google Artifact Registry as well. The definition mentioned in the link is the one you need to use for Google Artifact Registry.

If you are experiencing errors with that, then please provide the following info:

1. The full definition you have for the image in your bitbucket-pipelines.yml file after following the instructions on the link I shared
2. The error you get in the Pipelines build when you use this definition
   
   (the error you shared shows when you don't use authentication at all in the image definition, I would like to see what error you get when use authentication as per our documentation)

You could also create a support ticket via https://support.atlassian.com/contact/#/. A support ticket you create is visible only to you and Atlassian staff, so you can share there the URL of the build that failed when you used an image definition according to the link I shared. This way we can check if your definition is correct.

Kind regards,
Theodora