Bitbucket Pipelines: pulling an image from GCR with environment variables fails

Question

So I'm trying to use an image from my Google Container Registry, since this is a private registry I need to authenticate.

Obviously I don't want to renew my auth token every hour to make my pipelines work, so I need to go for the json key file.

It works when I define the image as follows:

image:
   name: eu.gcr.io/project_id/image:latest
   username: _json_key
   password: >
      {JSON file content}
   email: [email protected]

But that means your json key file is out in the open available for everyone with access to the pipelines fine to see, not what I'd like.

Then I've put the contents of the JSON file into an Environment Variable and replaced the actual json with the environment variable as follows:

image:
   name: eu.gcr.io/project_id/image:latest
   username: _json_key
   password: >
      ${JSON_KEY}
   email: [email protected]

Somehow in the second scenario it doesn't work :(

Answer 1

After some more testing, I found that this worked:

image:
   name: eu.gcr.io/project_id/image:latest
   username: _json_key
   password: '$JSON_KEY'