How to setup Jfrog docker repository as remote in GCP artifacts

[MuhammadElsaeed]

Hello All,

I have a problem configuring remote repository in GCP that point to our Jfrog docker repository.

I have created a gcp artifacts repo(europe-west1-docker.pkg.dev/<gcp-project>/jfrog-remote) that points to jfrog (<jfrog-url>/), note that gcp does not allow to set remote docker repo as path, just url(<jfrog-url>/) although, docker images are under a path (<jfrog-url>:443/artifactory/<docker-repo-local>/).

If I tried to pull the image through gcp artifacts registry but it can not be reached, I tried this command with the repo name in Jfrog

docker pull europe-west1-docker.pkg.dev/<gcp-project>/jfrog-remote/<docker-repo-local>/<image>:<tag>

then i get this error:

rror response from daemon: failed to resolve reference "europe-west1-docker.pkg.dev/<gcp-project>/jfrog-remote/<docker-repo-local>/<image>:<tag>": unexpected status from HEAD request to https://europe-west1-docker.pkg.dev/v2/<gcp-project>/jfrog-remote/<docker-repo-local>/<image>/manifests/<tag>: 403 Forbidden

I tried it again without the the repo name:

docker pull europe-west1-docker.pkg.dev/<gcp-project>/jfrog-remote/<image>:<tag>

then I got the same error:

Error response from daemon: failed to resolve reference "europe-west1-docker.pkg.dev/<gcp-project>/jfrog-remote/<image>:<tag>": unexpected status from HEAD request to https://europe-west1-docker.pkg.dev/v2/<gcp-project>/jfrog-remote/<image>/manifests/<tag>: 403 Forbidden

What did I do wrong? How can I properly pull the image?

[MJane]

Hi @MuhammadElsaeed ,

Welcome to Google Cloud Community!

The 403 Forbidden error when pulling images through your GCP Artifact Registry remote repository indicates an authentication or authorization problem between your GCP project and your JFrog Artifactory instance. 

Here are workarounds you can try to troubleshoot the issue: 

Verify Permissions - Ensure that the account you're using to pull the image has the necessary permissions. You need to grant the Artifact Registry Reader role to the service account that is pulling the image. 

Authentication -  Ensure Docker is correctly authenticated to access the repository. You may need to configure Docker to authenticate using a service account key.

Verify Correct Path -Verify that the full image path is correct. It should include the registry hostname, Google Cloud project ID, repository name, and image name.

Enable Audit Logs -  Enable audit logging for Artifact Registry to get more detailed information about the error. This can help you identify if there are any specific issues with permissions or authentication.

For more detailed information about troubleshooting container image issues you can read this documentation.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

[MuhammadElsaeed]

Hello MJane,
Thank you for the response, I  the token I used to authenticate to Jfrog is valid, if not, the GCP artifact will not even be created, and I was able to pull images with the same token from Jfrog directly.
I think it is more of a path issue but not sure how to solve it, you mentioned that we need to check the repository name, but which one exactly? the one in gcp? or in JFrog?, when I created the remote docker repository I have to write a url as the upstream not path, so I wonder how gcp would know which repository to pull from? as our JFrog instance has many repositories (docker, npm, etc.)

[PieterJanPinten]

I have the same with maven, it gives 403 with proper credentials.
We requested support, but so far that was not very useful. Did you find a way arround it?

[PieterJanPinten]

Hey,

Did you get any further with this?

I run into a similar issue with maven. I try to set up a remote to a jfrog upstream. The credentials are valid. You can provide a path with maven but it gives 403.

Since today, it appears that it's now no longer possible to actually create the repository if you don't turn of the validation. We tried to ask support for so far we did not get much further.
My guess is now that something broken in either jfrog or the gcp implementation which causes that the proxy in gcp performs an operation on jfrog which it does not understand.

My two reasons to asssume this:
1. if you provide invalid credentials to jfrog it will give a 401 error, not a 403 (you can try a curl to validate)
2. You get 403 when you do a webrequest to something it does not serve

On their documentation page on remotes, they only mention upstream nexus. They do mention jfrog.io in the tooltip where you need to provide the upstream repo. It's all pretty confusing...