<p>I have several Google cloud projects with dedicated environments for prod, stag, dev, etc. All the Docker image are platform agnostic and completely controlled by environment variables. They should be used from all environments. What I have found is to create a project, deploy the docker images <a href="https://cloud.google.com/artifact-registry/docs/docker/store-docker-container-images" rel="nofollow noreferrer">in the repository</a> and then allow read access by using a
<a href="https://stackoverflow.com/a/68799568/3351474">registry reader</a> to the consuming service accounts.</p>
<ol>
<li>What service account has to be added to the registry if GKE deployments should be able to pull the image?</li>
<li>Is this the recommended approach? I feels a little bit strange that also a dedicated project is needed. Is there something like a &quot;global&quot; repository?</li>
</ol>

k_o_
<blockquote>
<p>What service account has to be added to the registry if GKE
deployments should be able to pull the image?</p>
</blockquote>
<p>Use the <strong>workload identity</strong> with <strong>GKE</strong> : <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity</a></p>
<p>You can create a new <strong>service account</strong> in <strong>IAM</strong> and assign it necessary <strong>role/permission</strong> to it.</p>
<p>That <strong>GCP</strong> <strong>serviceaccount</strong> will used the of <strong>K8s service account</strong> and GKE <strong>workloads</strong> will be able to pull the images from the Docker registry.</p>
<p>So in this case you don't need to manage the <strong>ImagePull secret</strong>, refresh it from time to time and you can manage Auth by GCP service account.</p>
<p><strong>Update :</strong></p>
<p>Yes you can run the project for <strong>Docker Registry</strong> specifically, it's more depends on your need.</p>
<p>Just to mentioned if by Registry you mean <strong>GCR</strong> make sure it will get <strong>deprecated</strong> with time so check out the <strong>Artifact registry</strong>.</p>
<p>There is pros &amp; cons Keeping single Project specific to Docker registry</p>
<ul>
<li>Pros : Simplify management &amp; access control</li>
<li>Con : More difficult to <strong>isolate</strong> the Artifacts between projects.</li>
</ul>
<p>If all artifacts are stored in one <strong>project</strong> and all others pulling from there.</p>
<p>If you have sensitive artifacts that you don't want to be accessible to all projects, you will need to create separate <strong>repositories</strong> for those <strong>artifacts</strong>.</p>
