Pull OCI Bundle From GCP Artifact Registry

[strantalis]

I am struggling to pull an oci bundle from GCP Artifact Registry while running on GKE with workload identity.

Are there any examples of how to do this today with opa or maybe it's not possible yet?

I have been trying different settings for services[_].credentials.gcp_metadata but not really getting anywhere.

[strantalis]

I was able to figure this out. I forgot Artifact Registry is just GCS behind the scenes so just setting the right scope seemed to have worked.

services:
  policy-registry:
    url: https://us-docker.pkg.dev/<project id>
    type: oci
    credentials:
      gcp_metadata:
        scopes:
          - https://www.googleapis.com/auth/devstorage.read_only
bundles:
  entitlement-policy:
    service: policy-registry
    resource: us-docker.pkg.dev/<project id>/bundles/policy:0.0.2
    polling:
      min_delay_seconds: 60
      max_delay_seconds: 60