Google compute and servicce account for registry access

Question

I' ve got a private gitlab host and want to add some runners on gcp. So, I've:

• create a service account (with Editor rights on the project)
• create a compute instance (named gitlab-runner) with Ubuntu 16.04 on it and the service account associated.
• install gitlab-runner / kubectl / docker-ce on it
• register a runner of type shell
• register a runner of type docker

The runner shell have no problem what so ever.

The runner docker ? well... works with something like this

exemple:
  stage: build
  image: google/cloud-sdk:latest
  tags:
    - runner-docker
  script:
    - # do something here

My problem is when I want to use an image I previously build like this:

exemple2:
  stage: build
  image: eu.gcr.io/project/image_name:$CI_COMMIT_SHA
  tags:
    - runner-docker
  script:
    - # do something here

When I do this, gitlab-runner can't pull the image.

So, I've tried somehting like this: Access google container registry without the gcloud client

Then, whene I connect to the gitlab-runner (via ssh) I've no problem doing a pull.

But the runner can't.

Any idea what going wrong ?

---

I've done a temporay gitlab-ci.yml like this:

stage:
  - build
  - test

variables:
  CI_DEBUG_TRACE: "true"

test_gcloud_shell:
  stage: build
  tags:
    - shell
  before_script:
    - echo "disable before script"
  script:
    - docker run --rm eu.gcr.io/project/image_name:latest

test_gcloud_docker:
  stage: test
  image: eu.gcr.io/project/image_name:latest
  tags:
    - docker
  before_script:
    - echo "disable before script"
  script:
    - echo "hello"

The task test_gcloud_shell work without any problem, but not test_gcloud_docker. Any id ?

Answer 1

Have you set DOCKER_AUTH_CONFIG? See GitLab's docs and a similar issue.

You probably need to use the service account's JSON key file if you want long-lived credentials.