Answers: <p>Yes, it's possible. Fundamentally GCR is built on top of Cloud Storage, with roughly the same basic access control:</p>
  
  <ul>
  <li>public, i.e completely accessible</li>
  <li>private, with quite flexible access control from pretty much anywhere, even from outside the GCP domain - being in a certain GCP project is rather irrelevant.</li>
  </ul>
  
  <p>From <a href="https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry" rel="nofollow noreferrer">Granting users and other projects access to a registry</a>:</p>
  
  <blockquote>
    <p>To give specific users or container clusters running on other projects
    permissions to pull images from a registry, you need to grant read
    permission on the underlying Cloud Storage bucket.</p>
    
    <p>...</p>
    
    <ol start="4">
    <li>Select the <strong>Permissions</strong> tab.</li>
    <li>Click <strong>Add members</strong>.</li>
    <li><p>From the menu that appears, fill the <strong>Members</strong> field with the email addresses of users needing read permission, separated by commas.
    This email address can be one of the following:</p>
    
    <ul>
    <li>a Google account (for example, <code>someone@example.com</code>)</li>
    <li>a Cloud IAM service account</li>
    <li>the <a href="https://cloud.google.com/compute/docs/access/service-accounts#compute_engine_default_service_account" rel="nofollow noreferrer">Compute Engine default service account</a> of another project. This account is used by the Google Kubernetes Engine to pull
    container images clusters by default. It is in the form
    <code>[PROJECT_NUMBER]-compute@developer.gserviceaccount.com</code>, where
    <code>[PROJECT-NUMBER]</code> is the <a href="https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects" rel="nofollow noreferrer">GCP project number</a> of the project that
    is running the Google Kubernetes Engine cluster.</li>
    </ul></li>
    </ol>
  </blockquote>
  
  <p>There are some differences from Cloud Storage, most notable ones being:</p>
  
  <ul>
  <li>access control applies to the bucket level only, object level access is ignored</li>
  <li>GCR can only have a single bucket per GCP project</li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2019-03-16T03:24:05.433Z
Answers: 2019-03-16T03:24:05.433Z
Answers: Dan Cornilescu
Body: <p>Is it possible to pull images from the same <code>GCR</code> from multiple <code>GCP</code> projects without making the registry public?</p>
  
  <p>I want to do this so I do not have to upload multiple times the same image to multiple registries so it can be used on different projects.</p>
  
Tags: <docker><gcp>
Title: Google Cloud Registry and multiple projects
UserDisplayName: Navarro
ThreadText: # Google Cloud Registry and multiple projects
  
  (Asked by: username_0 on 2019-03-15)
  
  Is it possible to pull images from the same `GCR` from multiple `GCP` projects without making the registry public?
  
  I want to do this so I do not have to upload multiple times the same image to multiple registries so it can be used on different projects.
  
  **Tags:** docker, gcp
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-03-16. Score: 3 | Accepted answer
  
  Yes, it's possible. Fundamentally GCR is built on top of Cloud Storage, with roughly the same basic access control:
  
  * public, i.e completely accessible
  * private, with quite flexible access control from pretty much anywhere, even from outside the GCP domain - being in a certain GCP project is rather irrelevant.
  
  From [Granting users and other projects access to a registry](https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry):
  
  > To give specific users or container clusters running on other projects
  > permissions to pull images from a registry, you need to grant read
  > permission on the underlying Cloud Storage bucket.
  >
  > ...
  >
  > 4. Select the **Permissions** tab.
  > 5. Click **Add members**.
  > 6. From the menu that appears, fill the **Members** field with the email addresses of users needing read permission, separated by commas.
  >    This email address can be one of the following:
  >
  >    * a Google account (for example, `someone@example.com`)
  >    * a Cloud IAM service account
  >    * the [Compute Engine default service account](https://cloud.google.com/compute/docs/access/service-accounts#compute_engine_default_service_account) of another project. This account is used by the Google Kubernetes Engine to pull
  >      container images clusters by default. It is in the form
  >      `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`, where
  >      `[PROJECT-NUMBER]` is the [GCP project number](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects) of the project that
  >      is running the Google Kubernetes Engine cluster.
  
  There are some differences from Cloud Storage, most notable ones being:
  
  * access control applies to the bucket level only, object level access is ignored
  * GCR can only have a single bucket per GCP project
  
  
  ---
  
  