pr-mod | Reviewing pull-requests | Frontend Framework library

There is decent documentation about how to both push and pull images with GCR and GKE. Also, this answer is a similar answer for regular GCE instances.

Assuming your node pool is configured with instances using the default GCE account, this is a simple matter of configuring the pool with the read-write access scope when you create the pool.

A few ways to do this:

• When you create the node pool using gcloud, specify (additionally) --scopes https://www.googleapis.com/auth/devstorage.read_write (Alternatively, you can enable 'all scopes' using this value: https://www.googleapis.com/auth/cloud-platform, but that is exceptionally permissive)
• In the console when you are configuring the node pool, select the scope specifically (it defaults to only Read) or select "all scopes", e.g.:

... omitted many scope choices ...

If, for whatever reason, you can't just tear down your node pool, the instructions about how to migrate jobs to a new machine type should work for you (in this case, the "new machine type" just has the new access permissions). The basic steps are:

• Create the new node pool
• Cordon off (mark as unschedulable) the existing node pool (and drain the existing jobs off)
• Wait for jobs to migrate
• Delete the existing node pool

That said, it might make sense to go a bit beyond this and use a dedicated service account (and key) for pushing images, if you don't want any pod on your cluster to have this sort of access. Likewise, this won't require destroying and recreating the node pool.

This is a decent amount more complicated, but the steps would roughly be:

• Create an IAM account which has the necessary role (probably 'Storage Object Admin' -- but you'll need the ability to create the bucket on the first push).
• Generate a key for this IAM account.
• Deploy the key file with your job (presumably via a GKE secret)
• Authenticate to docker with the key file:

cat keyfile.json | docker login -u _json_key --password-stdin https://eu.gcr.io

(or whatever the correct GCR repository hostname is for you)