title: Authenticate private google cloud artifact registry from Tekton Pipeline
body: <p>I have a local setup of Tekton Pipeline, which has task to clone and build application . The code base is on java so, clones the code from BitBucket and does a Gradle build.</p>
  <p><strong>gradle.build</strong></p>
  <pre><code>repositories {
      mavenCentral()
      maven {
          url &quot;artifactregistry://${LOCATION}-maven.pkg.dev/${PROJECT}/${REPOSITORY}&quot;
      }
  }
  </code></pre>
  <p><strong>gradle.properties</strong></p>
  <pre><code>LOCATION=australia-southeast2
  PROJECT=fetebird-350310
  REPOSITORY=common
  </code></pre>
  <p>I have set up a service account and passed it to the pipeline run</p>
  <pre><code>apiVersion: v1
  kind: Secret
  metadata:
    name: gcp-secret
    namespace: tekton-pipelines
  type: kubernetes.io/opaque
  stringData:
    gcs-config: |
      {
        &quot;type&quot;: &quot;service_account&quot;,
        &quot;project_id&quot;: &quot;xxxxx-350310&quot;,
        &quot;private_key_id&quot;: &quot;28e8xxxxx2642a8a0cd9cd5c2696&quot;,
        &quot;private_key&quot;: &quot;-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3zOuPTogiZ2kU\nEYsGMCl4lUO48GSLOjOH1lwkQ76zxL\n0F6cfpV/8iwao/9IOqsmKoRPUZcQjqXFMEuCYJNhoScsn4TAYMNBeATVq+2JJ/5T\n2e7YfbbPVue9R36MfTwqDeI=\n-----END PRIVATE KEY-----\n&quot;,
        &quot;client_email&quot;: &quot;xxxxxx@xxxx-xxxx.iam.gserviceaccount.com&quot;,
        &quot;client_id&quot;: &quot;xxxxxxxxxxxxxxxxx&quot;,
        &quot;auth_uri&quot;: &quot;https://accounts.google.com/o/oauth2/auth&quot;,
        &quot;token_uri&quot;: &quot;https://oauth2.googleapis.com/token&quot;,
        &quot;auth_provider_x509_cert_url&quot;: &quot;https://www.googleapis.com/oauth2/v1/certs&quot;,
        &quot;client_x509_cert_url&quot;: &quot;https://www.googleapis.com/robot/v1/metadata/x509/fetebird%40fetebird-350310.iam.gserviceaccount.com&quot;
      }
  </code></pre>
  <p><strong>service-account</strong></p>
  <pre><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: service-account
  secrets:
    - name: git-ssh-auth
    - name: gcp-secret
  </code></pre>
  <p>During the Gradle build, getting an exception as</p>
  <pre><code>&gt; Could not resolve fete.bird:common:1.0.1.
  2022-06-22T12:43:41.599990295Z          &gt; Could not get resource 'https://australia-southeast2-maven.pkg.dev/fetebird-350310/common/fete/bird/common/1.0.1/common-1.0.1.pom'.
  2022-06-22T12:43:41.606630129Z             &gt; Could not GET 'https://australia-southeast2-maven.pkg.dev/fetebird-350310/common/fete/bird/common/1.0.1/common-1.0.1.pom'. Received status code 403 from server: Forbidden
  </code></pre>
  <p><a href="https://i.stack.imgur.com/L7xei.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/L7xei.png" alt="enter image description here" /></a></p>
  <pre><code>implementation(&quot;fete.bird:common:1.0.1&quot;) is published on GCP artifact registry
  </code></pre>
  <p>In local development, the Gradle build is working file, because the service key is exported as environment variable <code>export GOOGLE_APPLICATION_CREDENTIALS=&quot;file-location.json&quot;</code></p>
  <p><strong>Pipeline Run</strong></p>
  <pre><code>apiVersion: tekton.dev/v1beta1
  kind: PipelineRun
  metadata:
    name: run-pipeline
    namespace: tekton-pipelines
  spec:
    serviceAccountNames:
      - taskName: clone-repository
        serviceAccountName: git-service-account
      - taskName: build
        serviceAccountName: gcp-service-account
    pipelineRef:
      name: fetebird-discount
    workspaces:
      - name: shared-workspace
        persistentVolumeClaim:
          claimName: fetebird-discount-pvc
    params:
      - name: repo-url
        value: git@bitbucket.org:anandjaisy/discount.git
  </code></pre>