Accessing Private Google Artifact Registry with Poetry: Local and Docker Setup

DM Television

Microsoft rolls out Copilot Vision that reads the web with you

December

S	M	T	W	T	F	S
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30	31

Accessing Private Google Artifact Registry with Poetry: Local and Docker Setup

Tags: application applications google sdk

Author: DATE POSTED:November 28, 2024

Feed: Hacker Noon - Medium

View: Original article

\ When building Python applications with Poetry in a Docker container, we sometimes encounter issues accessing private packages stored in the Google Artifact Registry (GAR). Locally, this challenge arises because docker build cannot directly handle the Google Cloud credentials in the same way as our CI/CD pipeline, where we leverage service accounts and the Kaniko action for secure builds. To resolve this for local development, we'll configure Google Cloud credentials within Docker using Docker Compose, enabling secure access to the GAR repository during the build process.

Non-Containerized Pre-requirements

Python ^3.12
Poetry ^1.7.1
Google Cloud SDK ^489.0.0
Keyring ^24.0.0
keyrings.google-artifactregistry-auth ^1.0.0
Read access to your GAR Python repository
Logged into GCP (gcloud auth application-default login)

Setup

Keyring Setup

Install keyring support for Google Artifact Registry:

\

pip install keyring pip install keyrings.google-artifactregistry-auth

Connect Poetry to your GAR repo

Access to the private repository in the Google Artifact Registry can be managed through Poetry. First, configure a custom source in Poetry for the GAR repository by running:

\

poetry source add --priority=explicit https://-python.pkg.dev///simple

Be sure to append /simple to the repository URL for compatibility.

\ Now you can install packages from your private repo:

poetry add --source [email protected] Notes

In some cases, accessing the repository may require setting an explicit OAuth token for authentication in Poetry. Use the following command to configure this globally in Poetry:

poetry config http-basic. oauth2accesstoken $(gcloud auth print-access-token) Containerized Pre-requirements

Docker ^20.10
Docker Compose ^2.0
Google Cloud SDK ^489.0.0
Read access to your GAR Python repository
Logged into GCP (gcloud auth application-default login)

Setup

Secrets Configuration

First, define a secret in docker-compose.yaml using the local path to your credentials file:

\

secrets: gcloud_credentials: file: ~/.config/gcloud/application_default_credentials.json

We define gcloud_credentials.file as a consistent path for Unix-like environments in docker-compose.yaml:
This configuration securely passes the credentials file from your local machine to the build context without exposing sensitive data.

\

Dockerfile Adjustments

In the Dockerfile, we handle credentials with the following setup:

\

ARG GOOGLE_APPLICATION_CREDENTIALS ENV GOOGLE_APPLICATION_CREDENTIALS=${GOOGLE_APPLICATION_CREDENTIALS} RUN --mount=type=secret,id=gcloud_credentials \ mkdir -p $(dirname ${GOOGLE_APPLICATION_CREDENTIALS}) && \ cp /run/secrets/gcloud_credentials ${GOOGLE_APPLICATION_CREDENTIALS}

--mount=type=secret,id=gcloud_credentials: Securely mounts the credentials during the build process.
GOOGLE_APPLICATION_CREDENTIALS: Specifies the credential file's path within the container.

\

Service Configurations

Here, gcloud_credentials is the secret mounted at build time, as specified in the secrets configuration.

\

some-service: build: context: . dockerfile: ./Dockerfile.local args: GOOGLE_APPLICATION_CREDENTIALS: /tmp/application_default_credentials.json secrets: - gcloud_credentials Usage

Just run:

docker-compose up --build Conclusion

This approach allows local Docker builds to access private GAR resources securely, ensuring that credentials are handled appropriately and remain protected.

Feed: Hacker Noon - Medium

View: Original article

Tags: application applications google sdk