[Python] keyrings.google-artifactregistry.auth for python AR repo without a service account...

I don't use non-expiring service account json keys I use ambient creds and OIDC everywhere so I can't generate and use json keys for AR.

I want to do pip installs in my Dockerfiles to install my private AR packages.

Doing something like this works:

# Passing in a non expiring key
docker build -f "Dockerfile" \
--secret id=gcp_creds,src="gsa_key.json" .

##### IN DOCKERFILE
# I dont want to generate json keys like this
ENV GOOGLE_APPLICATION_CREDENTIALS=/run/secrets/gcp_creds

RUN pip install keyring keyrings.google-artifactregistry-auth
COPY requirements.txt requirements.txt
RUN --mount=type=secret,id=gcp_creds \
--mount=type=cache,target=target=/root/.cache \
pip install -r requirements.txt


Does keyrings.google-artifactregistry-auth support tokens somehow?

This did not work for example:

# GSA is active through ambient creds or impersonation
gcloud auth print-access-token > /tmp/token.json
# also tried: gcloud config config-helper --format="json(credential)" > /tmp/token.json

docker build -f "Dockerfile" \
--secret id=gcp_creds,src="/tmp/token.json" .


I'd like to avoid resorting to doing something like building outside of the container and copying the built artifacts in the image. I want to do the build inside the dockerfile.

EDIT


So I got this working with GCP provided GH actions tooling so I know its possible to generate temp tokens in a format the keyring will accept. I still want to know how to do this with the gcloud cli for other scenarios.

Using the dockerfile above and these GH actions steps I can auth via OIDC and generate a creds file the pip keyring provider accepts:

- id: 'auth'
name: 'auth to gcp'
uses: 'google-github-actions/auth@v2'
with:
token_format: 'access_token'
workload_identity_provider: 'projects/xxxxx/locations/global/workloadIdentityPools/github/providers/github'
service_account: xxxxxxxx

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- uses: docker/build-push-action@v6
with:
push: false
context: '.'
file: 'Dockerfile'
tags: myimage:mytag
load: true
cache-from: type=gha,scope=localbuild
cache-to: type=gha,mode=max,scope=localbuild
secret-files: |
gcp_creds=${{steps.auth.outputs.credentials_file_path}}

Continue reading...