gcloud artifacts docker upgrade migrate

개요

gcloud artifacts docker upgrade migrate

$ gcloud artifacts docker upgrade migrate
Repository report for my-project-802:

Container Registry Host  Location  Artifact Registry Repository
gcr.io                   us        None Found. Can create repo named "gcr.io"
us.gcr.io                us        None Found. Can create repo named "us.gcr.io"
asia.gcr.io              asia      None Found. Can create repo named "asia.gcr.io"
eu.gcr.io                europe    None Found. Can create repo named "eu.gcr.io"


gcloud can automatically create the 4 missing repos in Artifact Registry.
If you would like to setup CMEK for these repos, exit now and create them manually instead.

Create missing repos (recommended) (Y/n)?

Waiting for repo creation to complete......done.
Waiting for repo creation to complete......done.
Waiting for repo creation to complete......done.
Waiting for repo creation to complete......done.

Copying initial images (additional images will be copied later)...

Copying images for my-project-802... failed.

ERROR: The Artifact Registry service account doesn't have access to my-project-802 for copying images
The following command will grant the necessary access (may take a few minutes):
  gcloud projects add-iam-policy-binding my-project-802 --member='serviceAccount:service-468025791368@gcp-sa-artifactregistry.iam.gserviceaccount.com' --role='roles/storage.objectViewer'
You can re-run this script after granting access.

$ gcloud projects add-iam-policy-binding my-project-802 --member='serviceAccount:service-468025791368@gcp-sa-artifactregistry.iam.gserviceaccount.com' --role='roles/storage.objectViewer'
Updated IAM policy for project [my-project-802].
bindings:
- members:
  - serviceAccount:service-468025791368@gcp-gae-service.iam.gserviceaccount.com
  role: roles/appengine.serviceAgent
...
- members:
  - serviceAccount:mink-controller@my-project-802.iam.gserviceaccount.com
  - serviceAccount:service-468025791368@gcp-sa-artifactregistry.iam.gserviceaccount.com
  role: roles/storage.objectViewer
etag: BwDyaceF0gi=
version: 1

$ gcloud artifacts docker upgrade migrate
Repository report for my-project-802:

Container Registry Host  Location  Artifact Registry Repository
gcr.io                   us        projects/my-project-802/locations/us/repositories/gcr.io
us.gcr.io                us        projects/my-project-802/locations/us/repositories/us.gcr.io
asia.gcr.io              asia      projects/my-project-802/locations/asia/repositories/asia.gcr.io
eu.gcr.io                europe    projects/my-project-802/locations/europe/repositories/eu.gcr.io

OK: All Container Registry repositories have equivalent Artifact Registry repostories.


Copying initial images (additional images will be copied later)...

Copying images for my-project-802... done.

my-project-802: Successfully copied 4 additional tags and 3 additional manifests. There were 0 failures.
API [cloudasset.googleapis.com] not enabled on project [my-project-802]. Would you like to enable and retry (this will take a few minutes)? (y/N)?  y

Enabling service [cloudasset.googleapis.com] on project [my-project-802]...
Operation "operations/acat.p2-468025791368-579df136-b80e-246a-cfb8-d0a3c57eb9df" finished successfully.

Potential IAM change for gcr.io repository in my-project-802:

bindings:
...

This IAM policy will grant users the ability to perform all actions in Artifact Registry that
they can currently perform in Container Registry. This policy may allow access that was
previously prevented by deny policies or IAM conditions.
 [1] Apply above policy to the my-project-802/gcr.io Artifact Registry repository
 [2] Edit policy
 [3] Do not change permissions for this repo (users may lose access to gcr.io/my-project-802)
 [4] Skip permission updates for all remaining repos (users may lose access to all remaining repos)
 [5] Exit
Please enter your numeric choice (2):  1
...
Please enter your numeric choice (2):  1
...