3

Is it possible to pull images from the same GCR from multiple GCP projects without making the registry public?

I want to do this so I do not have to upload multiple times the same image to multiple registries so it can be used on different projects.

1 Answer 1

3

Yes, it's possible. Fundamentally GCR is built on top of Cloud Storage, with roughly the same basic access control:

  • public, i.e completely accessible
  • private, with quite flexible access control from pretty much anywhere, even from outside the GCP domain - being in a certain GCP project is rather irrelevant.

From Granting users and other projects access to a registry:

To give specific users or container clusters running on other projects permissions to pull images from a registry, you need to grant read permission on the underlying Cloud Storage bucket.

...

  1. Select the Permissions tab.
  2. Click Add members.
  3. From the menu that appears, fill the Members field with the email addresses of users needing read permission, separated by commas. This email address can be one of the following:

There are some differences from Cloud Storage, most notable ones being:

  • access control applies to the bucket level only, object level access is ignored
  • GCR can only have a single bucket per GCP project

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.