title: How to solve permissions for push to Google Artifact Registry from Cloud Build using jib-maven-plugin?
body: <p>This problem seems to be all about my permissions in GCP, but attempting to set the right permissions so far has not worked.</p>
  <p>I'm using <code>com.google.cloud.tools:jib-maven-plugin</code> to package a Spring Boot project into a container and push it to Google Artifact Registry (GAR). It works just fine when I run it locally, but it fails when I run the maven build with Google Cloud Build. It says it fails because <code>artifactregistry.repositories.downloadArtifacts</code> permission is missing.</p>
  <p>But this is one of the permissions enabled by default according to <a href="https://cloud.google.com/build/docs/cloud-build-service-account" rel="nofollow noreferrer">Google Docs</a>.</p>
  <p>My target is a Google Artifacts (docker) Registry. I'm able to change the target to a Google Container Registry (deprecated, so I need to change to GAR) and that works fine under Cloud Build, no permission problems there. The build also downloads jar files from a maven repository stored in a different GAR, though in the same Google project. So clearly it is okay with permissions for that maven GAR.</p>
  <p>I verified that running the maven build locally works, including writing to the GAR, which eliminates something going bad in the jib plugin configuration, or in the GAR configuration. This is using my own user credentials.</p>
  <p>What have I tried?</p>
  <ul>
  <li>I added the appropriate roles to the default service account Cloud Build uses (though they are supposed to be there anyway). The <code>downloadArtifacts</code> permission is included in role Artifact Registry Reader, so I added that role as well as Artifact Registry Writer.</li>
  <li>I switched to a different Service Account (build service account, let's call it BSA) and, yes, made sure that had the same appropriate roles (see above).</li>
  <li>I added the BSA as a principal to the target GAR and gave it the appropriate roles there as well (getting desperate)</li>
  <li>My user credentials include Owner role so I added Owner role to the BSA (not something I want to keep)</li>
  </ul>
  <p>All of these gave me the same permission denied error. Just in case I had really misunderstood something I added a step to my Cloud Build yaml to runs <code>gcloud info</code> and verified that, yes, it is using the BSA I have configured with the roles I need.</p>
  <p>Is there something I missed?
  Thanks</p>
  <p>...Edit
  More info. Most of my builds use jib but one uses Spotify to create a local docker image and then uses docker to push to the registry.
  And this works! So the problem is specific to jib. Somehow, under cloud build, jib is not seeing the creds, though it does see them locally.</p>
  <p>...Edit
  The actual error message:</p>
  <pre><code>Failed to execute goal com.google.cloud.tools:jib-maven-plugin:1.6.1:build (build-and-push-docker-image) on project knifethrower: Build image failed, perhaps you should make sure you have permissions for australia-southeast1-docker.pkg.dev/redacted/bonanza-platform/knifethrower and set correct credentials. See https://github.com/GoogleContainerTools/jib/blob/master/docs/faq.md#what-should-i-do-when-the-registry-responds-with-forbidden-or-denied for help: Unauthorized for australia-southeast1-docker.pkg.dev/redacted/bonanza-platform/knifethrower: 403 Forbidden
  [ERROR] {&quot;errors&quot;:[{&quot;code&quot;:&quot;DENIED&quot;,&quot;message&quot;:&quot;Permission \&quot;artifactregistry.repositories.downloadArtifacts\&quot; denied on resource \&quot;projects/redacted/locations/australia-southeast1/repositories/bonanza-platform\&quot; (or it may not exist)&quot;}]}
  [ERROR] -&gt; [Help 1]
  </code></pre>
  <p>Also note I'm using the latest version of jib: 3.1.4</p>
  <p>...Edit</p>
  <p>I've tried a couple more things. I added an earlier step, before the maven build, which does a <code>gcloud auth configure-docker --quiet --verbosity=debug australia-southeast1-docker.pkg.dev</code>. That creates a <code>/builder/home/.docker/config.json</code> file. Because there seems to be confusion about where that file should really live I copied it to <code>/root/.docker</code>. But that did not help.</p>
  <p>The second thing I tried was using the <code>$DOCKER_CONFIG</code> to point to the <code>/builder/home/.docker</code> directory (<a href="https://github.com/GoogleContainerTools/jib/blob/master/docs/faq.md#what-should-i-do-when-the-registry-responds-with-unauthorized" rel="nofollow noreferrer">as suggested here</a>) and that did not help either.</p>
  <p>Same error in both cases. I do get a message from the <code>gcloud auth configure-docker...</code></p>
  <pre><code>WARNING: `docker` not in system PATH.
  `docker` and `docker-credential-gcloud` need to be in the same PATH in order to work correctly together.
  gcloud's Docker credential helper can be configured but it will not work until this is corrected.
  Adding credentials for: australia-southeast1-docker.pkg.dev
  Docker configuration file updated.
  INFO: Display format: &quot;default&quot;
  </code></pre>
  <p>I think this is trying to be helpful and tell me it cannot find docker installed (which is true) but it created the creds anyway (also true). And it should not matter because jib doesn't rely on docker itself, just the creds. However it still doesn't work.</p>