How do I retrieve assets from a Google Storage bucket within a Google Container Registry automated build?

Question

I've created a mirrored GitHub repo in Google's Container Registry and then created a Build Trigger. The dockerfile in the repo includes gsutil -m rsync -r gs://asset-bucket/ local-dir/ so that I can move shared private assets into the container. But I get an error:

ServiceException: 401 Anonymous caller does not have storage.objects.list access to asset-bucket

I have an automatically created service account (@cloudbuild.gserviceaccount.com) for building and it has the Cloud Container Builder role. I tried adding Storage Object Viewer, but I still get the error.

Shouldn't the container builder automatically have the appropriate permissions?

Answer 1

Are you using the gcr.io/cloud-builders/gsutil build step to do this? That should use default credentials properly and it should Just Work.

steps:
  - name: 'gcr.io/cloud-builders/gsutil'
    args: [ "-m", "rsync", "gs://asset-bucket/", "local-dir/" ]

Alternatively, you could try the GCS Fetcher.