Menu
I am trying to create a service role for a drone instance which builds and pushed a docker image to Google Container Registry.
It works with the role project>owner (presumably project>editor would work too). I have not been able to find a way to restrict it only to have permission to push to GCR, or find out what the minimal permissions are.
662
You must grant the service account with IAM permissions to access the storage bucket used by Container Registry. The service account must have the cloud-platform scope. This scope grants permissions to push and pull images, as well as run gcloud commands.
The following page discusses the Identity and Access Management (IAM) permissions required to perform actions within the Cloud Storage portion of the Google Cloud console. IAM permissions are bundled together to make roles, and you grant roles to users and groups.
Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.
There is no permission to only allow it to push to GCR. The minimum permission to allow push is "Storage Object Creator". And this permission also allows the user to write to Google Cloud Storage, as suggested by the role's name.
Update: The correct minimum permission (IAM role) to allow push is "Storage Admin" based on current implementation.
57
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
