how do I pull in a private image from GCR if I'm running my workflow from a flyte sandbox?

I haven't tried that combination but I think if you generate an authentication key for GCR and then you create a K8s secret and get added that to the

imagePullSecrets

on the

default

Service Account it may work. I mean, sandbox uses k3s so it should be more or less the same for other K8s distro

I followed these instructions, created a secret based on the existing credentials, and added`imagePullSecrets` configuration to the

default

service account. I still got the 403: forbidden error and the pod failed with

ImagePullBackoff

What permissions have you set on the Google Service Account?

it's assigned the role

roles/storage.objectAdmin

not sure about the extent this is helpful for you, but I've followed these steps to get it to work with AR. It involve steps like doing a docker login

Thanks! let me try these steps