GCP Artifact Registry

Configure Valohai to pull private images from Google Cloud Artifact Registry.

Private registries are restricted to organization projects. Personal projects don't have access to private repositories.

Create a service account

1. Navigate to your Google Cloud project that hosts the Artifact Registry

2. Go to IAM & Admin → Service Accounts

3. Click Create Service Account

4. Add roles:

   • Service Account Token Creator (allows self-token creation)

   • Artifact Registry Reader (allows pulling images)

5. Create and download the JSON key file

Read more: GCP Artifact Registry access control

Add credentials to Valohai

1. Navigate to Hi, <n> (top-right menu) → Manage <organization>

2. Go to Registries under organization controls

3. Click Add a new entry

4. Configure:

   • Match pattern: <region>-docker.pkg.dev/<project-id>/*

     • Example: us-central1-docker.pkg.dev/my-project/*

     • Or narrow it: us-central1-docker.pkg.dev/my-project/ml-images/*

   • Registry type: GCP Artifact Registry

   • Service Account JSON: Paste the entire contents of your JSON key file

5. Save

Use the private image

Reference your Artifact Registry image in valohai.yaml:

- step:
    name: train
    image: us-central1-docker.pkg.dev/my-project/ml-images/training:v1.0
    command:
      - python train.py

Valohai handles authentication automatically.