Authenticate connector repositories to upstream sources

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This document describes how to authenticate to upstream sources for your Artifact Registry connector repositories.

This document assumes that you have already created an Artifact Registry connector repository and have an account with the external source.

For more information about connector repositories, see the Connector repositories overview.

Required roles

To get the permissions that you need to configure authentication to upstream sources for connector repositories, ask your administrator to grant you the following IAM roles on the project:

• Artifact Registry Admin (roles/artifactregistry.admin)
• Secret Manager Admin (roles/secretmanager.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

User-defined upstream sources

To configure authentication for user-defined upstream sources, complete the following steps.

Save your access token in a secret

1. Create an access token in the private registry.
2. Create a secret in Secret Manager.
3. Save your personal access token as a secret version.

Grant the Artifact Registry service account access to your secret

The Artifact Registry service agent acts on behalf of Artifact Registry when interacting with Google Cloud services. To allow the service agent to use secrets stored in Secret Manager, you must grant the service agent permission to view your secret version.

The service agent identifier is:

[e-mail]

PROJECT-NUMBER is the project number of the Google Cloud project where Artifact Registry is running.

To grant the Artifact Registry service agent the Secret Manager Secret Accessor role:

Console

1. Go to the Secret Manager page in the Google Cloud console.

   Go to the Secret Manager page

2. On the Secret Manager page, click the checkbox next to the name of the secret.

3. If it is not already open, click Show Info Panel to open the panel.

4. In the info panel, click Add Principal.

5. In the New principals text area, enter the email address(es) of the members to add.

6. In the Select a role dropdown, choose Secret Manager and then Secret Manager Secret Accessor.

gcloud

$ gcloud secrets add-iam-policy-binding secret-id \
    --member="member" \
    --role="roles/secretmanager.secretAccessor"

Where member is an IAM member, such as a user, group, or service account.

API

Note: Unlike the other examples, this replaces the entire IAM policy.

$ curl "https://secretmanager.googleapis.com/v1/projects/project-id/secrets/secret-id:setIamPolicy" \
    --request "POST" \
    --header "authorization: Bearer $(gcloud auth print-access-token)" \
    --header "content-type: application/json" \
    --data "{\"policy\": {\"bindings\": [{\"members\": [\"member\"], \"role\": \"roles/secretmanager.secretAccessor\"}]}}"

For more information on granting or revoking access to secrets, see Manage access to secrets.

Add upstream credentials to your connector repository

To update your connector repository with your upstream source credentials:

Console

1. Open the Repositories page in the Google Cloud console.

   Open the Repositories page

2. In the repository list, select the repository and click Edit Repository.

3. In the Connector repository authentication mode section, update or add your upstream source username and the secret containing your access token.

gcloud CLI

To update your connector repository with your upstream source credentials, run the following command:

gcloud artifacts repositories update REPOSITORY \
    --project=PROJECT_ID \
    --location=LOCATION \
    --remote-username=USERNAME \
    --remote-password-secret-version=projects/SECRET_PROJECT_ID/secrets/SECRET_ID/versions/SECRET_VERSION

Replace the following:

• REPOSITORY: the name of your Artifact Registry connector repository.
• PROJECT_ID: your Google Cloud project ID.
• LOCATION: the regional or multi-regional location for the repository. You can omit this flag if you set a default. To view a list of supported locations, run the command gcloud artifacts locations list.
• USERNAME: your upstream source username.
• SECRET_PROJECT_ID: the project ID of the project in which you created your secret.
• SECRET_ID: the name you gave your secret.
• SECRET_VERSION: the secret version you saved your access token in.

Your credentials are used the next time the connector repository sends a request for an artifact from the upstream source.