Pushing ang Image to GCR

[jperalmethodmaker]

Im trying to push in image to google cloud with jib in our quarkus project (Migrated from spring boot).
Im getting below errors when doing cloud build. Works ok in my local (Local Registry)
artifactregistry.repositories.downloadArtifacts\" denied on resource \"PROJECT HERE\" (or it may not exist)"

Im not sure what configuration i missed. we have done a gcloud auth configure-docker prior to the actual build which worked when it was still a spring boot.
Im not sure what to specify in the below config files since we are using service accounts.
quarkus.jib.base-registry-username
quarkus.jib.base-registry-password

Can you please guide me on this one.

[quarkus-bot[bot]]

/cc @geoand

[geoand]

I have never used google cloud before, but if you are trying to push an image image to a docker registry, what you need to configure is:

quarkus.container-image.username=...
quarkus.container-image.password=...

The properties you mentioned are used for pulling the base image from a private registry.

[jperalmethodmaker]

What does that do in practice? Does it create a docker configuration or something?

Yes it stores a json config file in {$HOME}/.docker/config.json

Althought i have noticed that in gcloud we it is stored in a different location not sure this fits from below documentation below. its stored in /builder/home/.docker.

https://github.com/GoogleContainerTools/jib/blob/master/jib-maven-plugin/README.md
Using Docker configuration files
Jib looks from credentials from $XDG_RUNTIME_DIR/containers/auth.json, $XDG_CONFIG_HOME/containers/auth.json, $HOME/.config/containers/auth.json, $DOCKER_CONFIG/config.json, and $HOME/.docker/config.json.

[geoand]

In Quarkus we don't use the Jib maven plugin, but we instead use Jib directly. https://github.com/quarkusio/quarkus/blob/2.8.0.Final/extensions/container-image/container-image-jib/deployment/src/main/java/io/quarkus/container/image/jib/deployment/JibProcessor.java#L317 is the piece of code that uses the well known credentials.

What registry is being used when you try to push to Google Cloud?

[jperalmethodmaker]

Currently we are using a private repo from google cloud. how is this being populated?
credentialRetrieverFactory

registryImage.addCredentialRetriever(credentialRetrieverFactory.wellKnownCredentialHelpers());
registryImage.addCredentialRetriever(credentialRetrieverFactory.dockerConfig())

[jperalmethodmaker]

Im not sure if i can share the exact url of our registry but its not th gcr.io from the samples.

[geoand]

Okay, that's basically what I wanted to know.

I am afraid I don't have the required Google cloud knowledge to be of much help here...

[geoand]

@loicmathieu have you perhaps used Quarkus with Jib on Google Cloud?

[jperalmethodmaker]

I was able to push my image now but we didn't use the built in quarkus jib. I tried jsonkey and oauthaccess token didn't seem to authenticate still for the push. We opted to use the jib-quarkus-extension-maven instead but it only supports legacy jars packaging

[loicmathieu]

Authentication to GAR is done in multiple steps, more info here: https://cloud.google.com/container-registry/docs/advanced-authentication

From local computer, you can use your gcloud account, here are the steps I use (replace with the correct GAR):

• run gcloud init and select the project id matching your target environment
• authenticate Docker with gcloud auth configure-docker http://europe-docker.pkg.dev (you must have been granted permission to push containers to the registry)
• authenticate kubectl with gcloud container clusters get-credentials $cluster_name --zone=europe-west4*

From our CI we authenticate using a GCP service account with the following steps:

• gcloud auth activate-service-account --key-file=${FILE}
• gcloud --quiet config set project ${GCP_PROJECT_ID}
• gcloud --quiet config set compute/zone europe-west4
• gcloud --quiet auth configure-docker $GAR_REGION

Or via Github action:

      # We setup Cloud SDK for prod first as we need to push to the prod GAR
      - id: 'auth-prod'
        uses: 'google-github-actions/auth@v0'
        with:
          credentials_json: '${{ secrets.GCLOUD_AUTH_PROD }}'

      - name: Set up Cloud SDK (Prod)
        uses: google-github-actions/setup-gcloud@v0
        with:
          project_id: ${{ env.PROD_PROJECT_ID }}

      - name: Configure Docker
        # we must specify the GAR_REGION because it's not in the default region handled by configure-docker
        run: |-
          gcloud --quiet auth configure-docker $GAR_REGION

Hope it will help

[jperalmethodmaker]

thanks @loicmathieu we are doing gcloud --quiet auth configure-docker on th CI part. It works for when we use the JIB plugin but not if we use the default jib inside quarkus.