JEN PERSON: Welcome to Getting Started with Artifact Registry.
In this video series, I'm going to walk you
through setting up some common use
cases for Artifact Registry.
But before I get into how to get started,
it'd probably make sense to tell you what Artifact Registry is.
Artifact Registry manages your container images and language
packages while integrating with Cloud's Build, Test, and Deploy
suite and third party CI/CD systems.
If you're familiar with Container Registry,
you're thinking Artifact Registry sure sounds similar,
and you're right.
Artifact Registry is the next generation
of Container Registry.
Container Registry has provided a single place
for your team to manage docker images,
perform vulnerability analysis, and decide
who can access what with fine-grained access control.
Existing CI/CD integrations let you
set up fully automated Docker pipelines to get fast feedback.
In an effort to build upon this powerful foundation,
Google Cloud created Artifact Registry.
Artifact registry offers even more fine-grained permissions,
allowing you to control access at the project or registry
level.
You can create multiple regional repositories
within a single Google Cloud project
you can create multiple repos under a project
with independent registry-specific permissions.
So you have control over where artifacts are stored
and who can access them.
After hearing about Artifact Registry,
I bet you can't wait to get started.
Let's walk through the steps using a hypothetical company
I've created, Drayne.
Drayne is autonomous, artificially intelligent,
voice-enabled plumbing for the modern home.
I'll make Drayne part of your pipeline using
Artifact Registry in the software pipeline.
Now.
If you don't think that's a little bit of money,
this is going to be a long video series for you.
You can create a new repository, list existing repositories,
and configure access controls through the GFP console
or through the gcloud command-line tool.
Today, I'm using gcloud.
to find out about setting up the G Cloud CLI check out the guide
link below.
All right, let's get started.
First, you'll need a Google Cloud project
with billing enabled.
You can use an existing project or create a new one.
Next, enable the Artifact Registry API in the console,
then open a new terminal window.
To create a new repository, type your gcloud command
in this format where repository is the name
of your new repository.
Format is the repository format, which is either
Docker, Maven, or NPM.
Location is the regional or multi-regional location
for the repository.
And you can leave aside if you set a default location.
And description is an optional description of the repository.
Including the async flag causes the command
to return immediately without waiting for the operation
in progress to complete.
So for example, here's a command from my Drayne app.
My repository is called Drayne Pipe, it's a Docker container,
the Location I've chosen is US Central-1,
And I've included this description
so I can easily track the contents of my repositories.
And here, is the results.
To view a list of repositories, you'll
want to run this command, where project is the Project ID.
If you don't include this flag, then the current or default
project is used.
Use the Location flag to view repositories
from a specific location.
You can also use Location All to list repositories
across all locations.
If you leave out the location flag,
the command uses the default location
if a default is configured.
And if there isn't a default location,
leaving out this flag, lists repositories
across all locations.
So when I run the command without a project or location,
I'm shown my current project here.
As you can see, creating and viewing your repositories
is super simple.
But before you dive headlong into Artifact Registry,
you have one very important consideration, security.
If you currently use any GCP products,
you're probably at least somewhat familiar
with the roles associated with access controls.
The most basic rules are owner, editor, and viewer.
And although you can use these primitive project-wide owner,
editor, and viewer roles to grant access to repositories,
using specific Artifact Registry roles
enables you to apply the security principle of least
privilege so that users and service accounts only
have access to the permissions that are required.
For example, the artifactregistry.reader role
allows a user to view and get artifacts
just from a specific project's repositories.
Whereas the roles/reader role allows the user
to view and get any existing resources and data from all
Cloud components of the project.
To grant a permission for a user,
naturally you grant a role that includes that permission.
Where appropriate you should use the Artifact Registry
roles to control access to your repositories, rather
than those project-wide roles.
You can grant these Artifact Registry roles, Reader, Writer,
Repository Administrator, and Administrator.
Let's grants some roles for the repository
we just made for my completely fake company, Drayne.
Again, I'm using the gcloud CLI because it rocks.
To add roles via the CLI, need to create a reference
policy file named policy.yaml.
In that file, I start with the bindings key,
then I name a role, and list members.
Here is a more complete reference policy example.
Notice I have an owner for the whole project and then Artifact
Registry specific roles.
For reader, you can see there is a service
account with read privileges and a specific user with read
privileges.
You can find a complete reference template
in the documentation, which contains more example
user and service account names.
To add a team member to a project
and grant them an Artifact Registry role,
I add them to the policy file.
Then, from the command line, I run this command,
passing the name of the project and the path to my .yaml file.
To get the currently configured policy,
I run gcloud project's get-iam-policy, passing
the name of the project.
And there you have it, you're ready to create
a new repository, list existing repositories,
and configure access controls for Artifact Registry.
But there's so much more to know about Artifact Registry.
Stay tuned for future episodes of Getting
Started with Artifact Registry.
And to see a guide on these tasks and so much more,
check out the documentation.
I'll see you next time.
[MUSIC PLAYING]