Configure authentication to Artifact Registry for Conda repositories

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

To allow the Conda CLI to access Artifact Registry repositories, you must provide an authentication token with requests to Artifact Registry. This page describes how to configure authentication with an Artifact Registry Conda package repository.

Note: You don't need to configure authentication for Cloud Build or Google Cloud runtime environments such as Google Kubernetes Engine and Cloud Run.

Before you begin

1. If you don't have a Conda repository yet, then create a Conda package repository.
2. Verify that Conda is installed. If Conda isn't installed, run and install Miniforge.
3. Verify that the user account or service account you are using has the required permissions to access the repository.

4. Install the Google Cloud CLI. After installation, initialize the Google Cloud CLI by running the following command:

   gcloud init

   If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.
5. (Optional) Configure defaults for gcloud CLI commands.

Authenticate a channel with oauth tokens

A Conda channel is the address to a location where one or more Conda packages are stored. Before you can install packages in your Conda environment, you must add the channel for that package to your Conda configuration file.

To allow the Conda CLI to call Artifact Registry directly, you must authenticate your Conda channel in Google Cloud by doing the following:

1. In the gcloud CLI, run the following command to store the identity of an oauth token in a TOKEN variable:

   export TOKEN="oauth2accesstoken:$(gcloud auth print-access-token)"
   

2. Add your Conda repository as a channel in your Conda configuration file:

   Conda

   conda config --add channels \
   https://$[e-mail]/PROJECT/REPOSITORY
   

   Miniforge

   conda config --add channels \
   https://$[e-mail]/PROJECT/REPOSITORY
   

   Mamba

   mamba config --add channels \
   https://$[e-mail]/PROJECT/REPOSITORY
   

   Micromamba

   micromamba config --add channels \
   https://$[e-mail]/PROJECT/REPOSITORY
   

   Note: The add command adds your channel to the beginning of the channel list in your configuration file. To add the channel to the end of the list, use --append instead.

   Where:

   • TOKEN stores the value of the oauth token generated by running oauth2accesstoken:$(gcloud auth print-access-token).
   • LOCATION is the regional or multi-regional location for the repository.
   • PROJECT is the ID of the project containing the repository.
   • REPOSITORY is the ID of the repository.

Refresh an expired oauth token

An oauth token expires after one hour. To re-authenticate your channel with a new token, do the following:

1. Remove your channel from your configuration file:

   Conda

   conda config --remove channels CHANNEL_NAME
   

   Miniforge

   conda config --remove channels CHANNEL_NAME
   

   Mamba

   mamba config --remove channels CHANNEL_NAME
   

   Micromamba

   micromamba config --remove channels CHANNEL_NAME
   

2. Follow the previous step that described creating a new oauth token.

3. Add your Conda repository back to your Conda configuration file, using your new token value.

What's next

• Configure access to repositories
• Learn about managing repositories
• Learn about managing packages