LinkedIn
Twitter
Hi All,
My team is planning on migrating from gcr to gcr.io domain hosted artifact registry.
I request everyone's help to confirm if I have all the prerequisites right before we do it. Let us know if we are missing any steps here.
Before migration:
authenticate to GCR.io using a service account key file.
Roles required by Artifact Registry SA:
artifactregistry.repositories.list – To list Artifact Repositories
roles/artifactregistry.reader
roles/artifactregistry.writer
roles/storage.objectViewer
Roles required by User to generate IAM Recommendations:
roles/storage.objectViewer
roles/iam.roleViewer
roles/serviceusage.serviceUsageConsumer
Roles required by user to confirm the transition:
roles/artifactregistry.admin
roles/storage.admin
roles/viewer
Artifact Registry roles to be granted with Current roles for respective users:
Migration steps:
- Install Google Cloud CLI or gcloud components update
gcloud services enable \
cloudresourcemanager.googleapis.com \
artifactregistry.googleapis.com - gcloud init
- #Enable Artifact Registry API#
- gcloud artifacts docker upgrade migrate \
--projects=Project_ID
Migration verification:
- Users and service accounts that use Container Registry can still push, pull, and deploy images when redirection is enabled.
- Your automation only pushes images to existing repositories.
- If you use Binary Authorization, your existing policies work correctly for images deployed from gcr.io repositories.
- Configured Pub/Sub subscriptions include notifications for changes in your gcr.io repositories.
After migration (Post verification) (Cost reduction):
- Go to cloud storage page in GCP Console.
- Verify the existence of us.artifacts.PROJECT-ID.appspot.com
- Delete us.artifacts.PROJECT-ID.appspot.com
Thank you!
