<p>I am looking to pull a container from Google Container Registry that exists in one Google Cloud Platform project into a Google Kubernetes Engine cluster that exists in a separate GCP project. </p>

<p>There's a good resource on this here: <a href="https://medium.com/hackernoon/today-i-learned-pull-docker-image-from-gcr-google-container-registry-in-any-non-gcp-kubernetes-5f8298f28969" rel="nofollow noreferrer">https://medium.com/hackernoon/today-i-learned-pull-docker-image-from-gcr-google-container-registry-in-any-non-gcp-kubernetes-5f8298f28969</a> but it includes the complexity of a non-GCP project. My guess is that there's an easier approach since everything here resides in Google Cloud Platform.</p>

<p>Thanks,</p>

Wunderbread
<p><a href="https://medium.com/google-cloud/using-single-docker-repository-with-multiple-gke-projects-1672689f780c" rel="noreferrer">https://medium.com/google-cloud/using-single-docker-repository-with-multiple-gke-projects-1672689f780c</a></p>

<p>This Medium post from way back seems to describe what you are trying to do. In short: you need to give “Storage Object Viewer” IAM permission to the service account of the cluster that wants to pull images from the other project's registry. The name of the role isn't exactly intuitive but sort of makes sense when you consider that the images are stored in cloud storage.</p>
