GitHub Workflow推送Docker镜像至Artifact Registry遇权限错误如何解决？

排查与修复步骤 #

1. 验证服务账号角色与权限绑定 #

• 本地测试服务账号权限：使用服务账号密钥本地执行认证和推送，确认权限是否正常：

  # 激活服务账号
  gcloud auth activate-service-account --key-file=your-service-account-key.json
  # 登录Artifact Registry
  gcloud auth configure-docker europe-west9-docker.pkg.dev
  # 尝试推送测试镜像
  docker push europe-west9-docker.pkg.dev/[PROJECT_ID]/docker/app-api:test-tag
  

• 确认角色绑定层级：确保Artifact Registry Writer角色绑定到目标仓库或整个项目，而非仅GKE集群等子资源。在GCP控制台查看服务账号的角色列表，确认artifactregistry.repositories.uploadArtifacts权限已生效。

2. 调整GitHub Workflow认证配置 #

• 升级google-github-actions/auth版本到最新稳定版（如v2），旧版本可能存在认证逻辑缺陷：

  - name: Authenticate to Google Cloud
    id: auth
    uses: 'google-github-actions/auth@v2'
    with:
      credentials_json: '${{ secrets.KEY}}'
  

• 移除token_format: 'access_token'参数：默认认证方式已支持Docker登录，指定该参数可能导致token权限范围受限，无法覆盖Artifact Registry操作。

3. 调整Workflow步骤顺序 #

将Set up GKE credentials步骤移到镜像推送之后，避免GKE凭证覆盖当前Docker认证上下文：

- name: Checkout
  uses: actions/checkout@v3

- name: Authenticate to Google Cloud
  id: auth
  uses: 'google-github-actions/auth@v2'
  with:
    credentials_json: '${{ secrets.KEY}}'

- name: Docker configuration
  run: |-
    echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://$REGION-docker.pkg.dev

- name: Set up JDK 17
  uses: actions/setup-java@v3
  with:
    java-version: '17'
    distribution: 'zulu'
    cache: maven

- name: Build with maven
  run: mvn clean package -pl ./app-api -am

- name: Build the docker image
  run: |-
    docker build ./app-api --no-cache --progress=plain \
      --tag "$REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA" \
      --build-arg GITHUB_SHA="$GITHUB_SHA" \
      --build-arg GITHUB_REF="$GITHUB_REF"

- name: Push the docker image to Artifact Registry
  run: |-
    docker push "$REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA"

# 移至镜像推送完成后执行
- name: Set up GKE credentials
  uses: google-github-actions/get-gke-credentials@v2
  with:
    cluster_name: ${{ env.CLUSTER }}
    location: europe-west9

4. 确认Artifact Registry仓库配置 #

• 检查仓库存在性：在GCP控制台的Artifact Registry中，确认projects/[PROJECT_ID]/locations/europe-west9/repositories/docker仓库已创建，区域和名称与Workflow变量完全匹配。
• 检查仓库访问控制：确保仓库未设置特殊访问限制，服务账号所在项目拥有合法访问权限。

内容的提问来源于stack exchange，提问作者Serkox