docs: updated prereqs documentation for Agent deployment on GKE #512
Conversation
vicentefb
commented
Jul 15, 2025
vicentefb
commented
- Based on this comment, updated prereqs section for agent deployment on GKE documentation
docs/deploy/gke.md
Outdated
| * **Artifact Registry Writer** (`roles/artifactregistry.writer`): To push the agent's container image. | ||
| * **Cloud Build Editor** (`roles/cloudbuild.builds.editor`): To interact with CloudBuild. | ||
|
|
||
| * The Cloud Build service account (which looks like `[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com`) must have the Storage Admin (`roles/storage.admin`) role to push the built container image to Google Container Registry. |
There was a problem hiding this comment.
GCR is deprecated. Artifact Registry is what everyone should be using now.
There was a problem hiding this comment.
Ok, i've tested the adk command in a new project with bare minimum permissions and this is the list of the needed ones:
-
roles/artifactregistry.createOnPushWriter:To push the built container image to Artifact Registry AND to automatically create the gcr.io repository within Artifact Registry the very first time an image is pushed to a gcr.io path in the project -
roles/logging.logWriter:To allow the Cloud Build job to send its logs to Cloud Logging. (NOTE: this doesn't necessarily stop the adk command from running successfully but it will show an INFO message about not having permission to write logs to CloudLogging) -
roles/storage.objectViewer:To allow the Cloud Build job to read the source code bundle that gcloud builds submit uploads to the project's Cloud Storage bucket
|
To ensure the instructions are correct, please exercise the steps from scratch in a new GCB project. |
vicentefb
force-pushed
the
UpdateGkeAgentDeployPreReqsDocumentation
branch
from
fb21134 to
15b18f1
Compare
updated iam permissions removed coming soon
vicentefb
force-pushed
the
UpdateGkeAgentDeployPreReqsDocumentation
branch
from
e1abea3 to
f920afa
Compare
|
ping @moficodes |
