Migration from container registry to Artifact Registry

[srinathjamboju]

Hello,

I've a few questions regarding the migration of images from container registry to Artifact Registry.

I've selected the transition option to move the images to gcr.io repositories in Artifact Registry (options are explained in transition-tooling

This option states that the transition is completed without requiring any downtime or service disruption.

Note: From below, the shortcuts CR and AR refers to Container Registry and Artifact Registry respectively.

Below are some of the questions that I wanted to get clarified in relating to the above statement.

1. Will there be any change in the path of the image once it is moved to Artifact Registry? The container registry so far has the pull path gcr.io/project-name/image:tag. I would like to know if my application can still work with the same path, when the image is moved over and the traffic is routed to Artifact Registry?
2. On continuation to above, The 2nd limitation from here states that "Each Container Registry hostname maps to only one corresponding Artifact Registry gcr.io repository in the same multi-region". Does this limitation mean, that my current images in CR with path such as gcr.io/project-a/image1:tag, gcr.io/project-a/image2:tag will need to be converted as gcr.io/project-a/repository1/image1:tag, gcr.io/project-a/repository2/image2:tag ? If that's the case, is GCP going to translate this mapping without having to change anything in the docker or k8s manifest files. If not so, how can this be called as a change without disruption?
3. I've different GCP projects where the container registry is enabled. Will there be any impact to other projects if I transition these images to AR in the same project? I don't have any containers that pull the images across the projects, so that is not my concern. My problem is, I don't want CRs in other projects to be impacted the moment I initiate migrate in a different project.

Thanks

[-Rhett · Accepted solution]

Hi @srinathjamboju,

If you decide to migrate your images to Artifact Registry, we highly recommend using the automatic migration tool as this method reduces the complexity of the migration process compared to a manual migration.

On the statement, “You can migrate Container Registry endpoints to Artifact Registry gcr.io repositories without requiring any downtime or service disruption” this only applies when using the automatic migration tool. Users who manually migrate are still expected to configure their repositories to follow the limitations.

For your follow up questions:

1. Will there be any change in the path of the image once it is moved to Artifact Registry? The container registry so far has the pull path gcr.io/project-name/image:tag. I would like to know if my application can still work with the same path, when the image is moved over and the traffic is routed to Artifact Registry?
   
   Yes, you are correct. The path that works for CR should also work with AR.
2. On continuation to above, The 2nd limitation from here states that "Each Container Registry hostname maps to only one corresponding Artifact Registry gcr.io repository in the same multi-region". Does this limitation mean, that my current images in CR with path such as gcr.io/project-a/image1:tag, gcr.io/project-a/image2:tag will need to be converted as gcr.io/project-a/repository1/image1:tag, gcr.io/project-a/repository2/image2:tag ? If that's the case, is GCP going to translate this mapping without having to change anything in the docker or k8s manifest files. If not so, how can this be called as a change without disruption?
   
   There’s no need to rename any path, as the CR path is expected to also work with AR.
3. I've different GCP projects where the container registry is enabled. Will there be any impact to other projects if I transition these images to AR in the same project? I don't have any containers that pull the images across the projects, so that is not my concern. My problem is, I don't want CRs in other projects to be impacted the moment I initiate migrate in a different project.
   
   Your other projects should generally not be impacted after the migration.

To summarize, using the automatic migration tool should ensure that your images will work in Artifact Registry just as they did in Container Registry.

However, if you encounter any hiccups after the migration, feel free to reach out to Google Cloud support, create a new bug on the issue tracker, or update this thread. If you decide to create a new bug, include steps to replicate, configuration settings, screenshots, and other details of the issue to help us investigate. While there isn’t a specific timeframe for resolution, once we've fixed an issue in production we'll indicate this and then update and close the bug.

Was my response helpful? If so, feel free to accept this answer as “Solution”. If you need more assistance with Google Cloud, you may also reply here within two business days. Share your logs, screenshots, or any additional errors you might have received and I’ll be happy to help.

[mayurii]

@-Rhett 
Hello,

I just read that i can automate the migration using  

gcloud artifacts docker upgrade migrate

- I am wondering if anything goes wrong with the migration, can i roll back to the GCR ? 
- is there anything should i change to the service account so i'll be able to push&pull images ? current role is for example : roles/storage.objectAdmin do i have to add extra roles for the artifact registry ?

[srinathjamboju]

Hi @mayurii 

you can revert until March 18, 2025 using the command below
gcloud artifacts settings disable-upgrade-redirection --project=PROJECT_NAME

You need Artifact Registry Reader role for the account where you used to pull the images, and Artifact Registry Writer role for writes/push.

Please note, if you have many versions of the images and don't need all of them, I recommend you clean before migration, so it becomes easy.