# Issues with Private GCP Container Registry

**URL:** <https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256>\
**Category:** Drone Support\
**Created:** [February 27, 2020, 11:13pm UTC](https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256 "2020-02-27T23:13:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lo\_ronk](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/lo_ronk/32/5519_2.png) [@lo\_ronk](https://drone.discourse.group/u/lo_ronk)\
**Post date:** [February 27, 2020, 11:13pm UTC](https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256/1 "2020-02-27T23:13:48Z")

</div>

Hello –

I am having some issues with setting up private image pulls from a GCP Registry. I am attempting to use a Service Account in GCP to set this up. Essentially, I have performed the following steps:

1. Created a json key file with the correct permissions in my GCP project that houses my container images.
2. Downloaded my key file and ran the following command against the key file:  
`cat account.json | docker login -u _json_key --password-stdin https://gcr.io`
3. Confirmed that once the docker login succeeded that I could pull images from that registry

At this point I logged into Drone and added a secret named `dockerconfig` with the contents of my `/.docker/config.json` from the previous steps. I then setup a pipeline that looks something like this:

```auto
#---------------#
# Pipeline One #
#---------------#
kind: pipeline
type: docker
name: pipeline-1

environment:
  SOME_VARIABLES: blah

steps:
...
- name: Step-that-matters
  image: gcr.io/<my-project>/<my-image>
...

image_pull_secrets:
- dockerconfig

trigger:
  event:
  - pull_request

#END OF PIPELINE ONE
---
# START OF SECOND PIPELINE
#---------------#
# Pipeline two #
#---------------#
kind: pipeline
type: docker
name: pipeline-2

...

trigger:
  branch:
  - master
  event:
  - push

```

However, every time this pipeline reaches the step where it needs to download the private image I receive the following error:

```auto
<pipeline-name>: Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

```

I have triple checked my permissions at this point although this was confirmed in Step 3 from above. Is there something else I am missing or some formatting issue I have?

Let me know if you need any additional info and thank you!!

---

<div class="post-metadata">

**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\
**Post date:** [February 27, 2020, 11:24pm UTC](https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256/2 "2020-02-27T23:24:53Z")

</div>

we have the root cause and solution documented here: [https://github.com/drone/drone-runtime/issues/55](https://github.com/drone/drone-runtime/issues/55)

---

<div class="post-metadata">

**Author:** ![lo\_ronk](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/lo_ronk/32/5519_2.png) [@lo\_ronk](https://drone.discourse.group/u/lo_ronk)\
**Post date:** [February 28, 2020, 2:56pm UTC](https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256/3 "2020-02-28T14:56:39Z")

</div>

Thanks for the follow up. Unfortunately, I never had any entires to `https://gcr.io` within my `config.json` to begin with. What I essentially had was something that looked like this:

```auto
{
        "auths": {
                "gcr.io": {
                        "auth": "PRIVATE_KEY"
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/19.03.5 (linux)"
        }
}

```

I stripped it down to look like this prior to adding it as a secret:

```auto
{
        "auths": {
                "gcr.io": {
                        "auth": "PRIVATE_KEY"
                }
        }
}

```

But still had no luck. I have gotten this to work in the past but I don’t recall doing anything different from what I described above. Is there something else I am missing?

Thanks again for the help!

---

<div class="post-metadata">

**Author:** ![lo\_ronk](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/lo_ronk/32/5519_2.png) [@lo\_ronk](https://drone.discourse.group/u/lo_ronk)\
**Post date:** [February 28, 2020, 3:52pm UTC](https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256/4 "2020-02-28T15:52:27Z")

</div>

Just to add to this – I tried a few more things without any luck. The first one was I changed the format of my `dockerconfigjson` secret entry to look like this (I didn’t expect this to work but tried it anyways):

```auto
{
        "auths": {
                "gcr.io": {
                        "auth": "my-key"
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/19.03.6 (linux)"
        }
}

```

Next, I tried to remove my second pipeline in case that was causing some issues. Finally, I added a tag on the image pull so it looked something like this `image: gcr.io/foo-project/blah-image:latest` but unfortunately still had no luck.

These were all complete shots in the dark but thought I would add some more information for things I have tried.

Thanks!

---

<div class="post-metadata">

**Author:** ![lo\_ronk](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/lo_ronk/32/5519_2.png) [@lo\_ronk](https://drone.discourse.group/u/lo_ronk)\
**Post date:** [February 28, 2020, 3:56pm UTC](https://drone.discourse.group/t/issues-with-private-gcp-container-registry/10256/5 "2020-02-28T15:56:04Z")

</div>

Disregard the above. I found the issue. This was stated in the document [here](http://discuss.harness.io/t/how-to-pull-private-images-with-1-0/3155) I just completely missed it. I needed to add the `Allow Pull Requests` option on my secret. Whats interesting is I know I have not added that to my secret in the past and it has worked. Regardless, the issue is resolved.

Thanks for the help again!