Unable to push to Google Container Registry

Drone Support
1

I’m trying to use image plugins/gcr to build and push docker to gcr.io for our project. Drone keeps giving me this error:

Successfully built a30e54b18226
Successfully tagged 115af9cc00fb81d25e903b7246edc0de61426031:latest
+ /usr/local/bin/docker tag 115af9cc00fb81d25e903b7246edc0de61426031 gcr.io/project-id/repo:latest
+ /usr/local/bin/docker push gcr.io/project-id/repo:latest
The push refers to a repository [gcr.io/project-id/repo]
3a67be3257c8: Preparing
f082cd9df19a: Preparing
4e0b03ab20f4: Preparing
3179dff912f9: Preparing
0a6cba3d2445: Preparing
11f8b35f152b: Preparing
6bc5936494e3: Preparing
11f8b35f152b: Waiting
6bc5936494e3: Waiting
time="2017-12-04T09:59:45.851797448Z" level=error msg="Upload failed: denied: Unable to access the repository, please check that you have permission to access it." 
time="2017-12-04T09:59:45.854964304Z" level=info msg="Attempting next endpoint for push after error: denied: Unable to access the repository, please check that you have permission to access it." 
denied: Unable to access the repository, please check that you have permission to access it.
time="2017-12-04T09:59:45Z" level=fatal msg="exit status 1"

It seems plugins/gcr use docker push, but I can’t use this command for publishing to gcr. Is there any version of plugins using gcloud docker -- push command to publish docker to gcr?

2

The gcr plugin uses the docker push command in conjunction with the _json_key as described in the official documentation [1].

This particular plugin does not use the gcloud command. If you need to use the gcloud command line tools to push images, we would recommend that you create your own custom plugin.

[1] https://cloud.google.com/container-registry/docs/advanced-authentication#using_a_json_key_file

3

Thank you for clarification. I tried to use docker login in simple linux environment and it worked! I think it’s the authentication problem. I use drone secret add to inject password to plugins/gcr as below:

drone secret add \
--repository my-github-account/my-repo \ 
--name google_key \
--value @/absolute/path/to/file/keyfile.json

Is this the right way to add new secret to drone server? My gcr setting is like this:

publish:
    image: plugins/gcr
    repo: gcr-project-id/repo-name
    tag: latest
    previleged: true
    environment:
      - DOCKER_LAUNCH_DEBUG=true
    token: >
      $$GOOGLE_KEY
    storage_driver: vfs
4

this is not the correct syntax:

    token: >
      $$GOOGLE_KEY

Please see the following documentation for the correct secret syntax:

5

It worked if I use json_key and directly paste the content of service account json token there like:

json_key: >
  {
    "type": "service_account",
    ......
    ......
   }

But I still couldn’t use the secret I add like this:

json_key: >
  $$GOOGLE_KEY

$$GOOGLE_KEY are mentioned here:

Is this wrong way to inject secret?

6

But I still couldn’t use the secret I add like this:

You cannot add the secret using the $$GOOGLE_KEY syntax because it is not the correct syntax. Please see these links which detail how to use secrets and include examples with the correct syntax: