> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Run images from Google Artifact Registry

<Info>Passwordless setup is available only on Astro dedicated clusters. For Astro standard clusters, follow the steps in [Private Registry](/docs/astro/kpo-private-registry) to create a Kubernetes secret containing your registry credentials.</Info>

By default, the `KubernetesPodOperator` expects to pull container images that are hosted publicly. If your images are hosted on the container registry native to your cloud provider, you can grant access to the images directly.

## Prerequisites

* An [Astro project](/docs/cli/v1.43/get-started-cli).
* An [Astro Deployment](/docs/astro/deployment-settings).
* Access to your Google Artifact Registry repository.

## Setup

If your container image is hosted in Google Artifact Registry repository, add a permissions policy to the repository to allow the `KubernetesPodOperator` to pull the Docker image. You don't need to create a Kubernetes secret or specify the Kubernetes secret in your dag. Docker images hosted in Google Artifact Registry repositories can be pulled only to Deployments hosted on GCP clusters.

<Steps>
  <Step title="Request the Compute Engine default service account ID">
    Contact [Astronomer support](https://support.astronomer.io) to request the Compute Engine default service account ID for your cluster.
  </Step>

  <Step title="Add Google Artifact Registry repository permissions">
    1. Log in to Google Artifact Registry.
    2. Click the checkbox next to the repository that you want to use.
    3. In the **Properties** pane that appears, click **ADD PRINCIPAL** in the **PERMISSIONS** tab.
    4. In the **Add Principals** text box, paste the Compute Engine default service account ID that was provided to you by Astronomer Support.
    5. In the **Assign Roles** selector, search for `Artifact Registry Reader` and select the role that appears.
    6. Click **Save** to grant read access for the registry  to Astro.
  </Step>

  <Step title="Set up the KubernetesPodOperator">
    The following snippet is the minimum configuration you'll need to create a `KubernetesPodOperator` task on Astro:

    ```python wrap theme={null}
    from airflow.configuration import conf
    from airflow.providers.cncf.kubernetes.operators.pod import KubernetesPodOperator

    namespace = conf.get("kubernetes", "NAMESPACE")

    KubernetesPodOperator(
        namespace=namespace,
        image="<your-docker-image>",
        cmds=["<commands-for-image>"],
        arguments=["<arguments-for-image>"],
        labels={"<pod-label>": "<label-name>"},
        name="<pod-name>",
        task_id="<task-name>",
        get_logs=True,
        in_cluster=True,
    )
    ```

    For each instantiation of the `KubernetesPodOperator`, you must specify the following values:

    * `namespace = conf.get("kubernetes", "NAMESPACE")`: Every Deployment runs on its own Kubernetes namespace within a cluster. Information about this namespace can be programmatically imported as long as you set this variable.
    * `image`: This is the Docker image that the operator will use to run its defined task, commands, and arguments. Astro assumes that this value is an image tag that's publicly available on [Docker Hub](https://hub.docker.com/). To pull an image from a private registry, see [Pull images from a Private Registry](/docs/astro/kpo-private-registry).
    * `in_cluster`: If a Connection object is not passed to the `KubernetesPodOperator`'s `kubernetes_conn_id` parameter, specify `in_cluster=True` to run the task in the Deployment's Astro cluster.
  </Step>

  <Step title="Add the Google Artifact Registry URI">
    When you configure an instantiation of the `KubernetesPodOperator`, replace `<your-docker-image>` with the Google Artifact Registry image URI. To retrieve the URI:

    * In the Google Artifact Registry, click the registry containing the image.
    * Click the image you want to use.
    * Click the copy icon next to the image in the top corner. The string you copy should be in the format `<GCP Region>-docker.pkg.dev/<Project Name>/<Registry Name>/<Image Name>`.
  </Step>
</Steps>