Google Cloud CI/CD, Build and Push Docker Images to Google Cloud Artifact Registry

Build a Docker image and publish it to Google Cloud Artifact Registry in a single Kestra flow. This blueprint solves a common CI gap: you need a reproducible container build that authenticates to a private GCP registry without baking long-lived keys into your pipeline. It mints a short-lived OAuth access token from a service account, then builds and pushes a tagged image to a regional Artifact Registry repository, ready for GKE, Cloud Run, or Kubernetes deployments.

How it works

1. The fetch_auth_token task (io.kestra.plugin.gcp.auth.OauthAccessToken) reads the service account JSON from a Kestra secret and exchanges it for a short-lived OAuth access token scoped to your projectId.
2. The build task (io.kestra.plugin.docker.Build) builds an image from an inline dockerfile (here a Python 3.10 base with kestra, requests, and polars), then with push: true ships it to Artifact Registry.
3. Registry authentication uses the credentials block: the username oauth2accesstoken plus the token from {{ outputs.fetch_auth_token.accessToken.tokenValue }} as the password.
4. The image tags pin the regional registry host, project, repository, and tag (for example europe-west3-docker.pkg.dev/your_gcp_project_id/kestra/polars:latest).

What you get

• A reproducible Docker build defined declaratively in YAML.
• Secure registry access via short-lived OAuth tokens, no static registry passwords.
• A versioned image in Artifact Registry, ready for downstream deploys.
• A reusable CI step you can wire into larger orchestration flows.

Who it's for

• Platform and DevOps engineers automating container delivery on GCP.
• Data engineers packaging custom runtime images for Kestra task runners.
• Cloud infrastructure teams standardizing build and push pipelines.

Why orchestrate this with Kestra

Artifact Registry stores images but does not build them or decide when a build runs. Kestra fills that gap: trigger builds on Git pushes, schedules, or upstream flow events, add retries and errors handling for flaky network or registry calls, capture full execution lineage and logs, and keep the whole pipeline as declarative, version-controlled YAML. Secrets stay out of the flow and tokens stay short-lived.

Prerequisites

• A GCP project with Artifact Registry enabled and a repository created.
• A service account with permission to push to Artifact Registry.
• A Docker-capable task runner available to Kestra.

Secrets

• GCP_CREDS: the GCP service account JSON used by io.kestra.plugin.gcp.auth.OauthAccessToken.

Quick start

1. Add the GCP_CREDS secret with your service account JSON.
2. Set projectId in fetch_auth_token to your GCP project.
3. Update the image tags to your region, project, repository, and tag.
4. Adjust the inline dockerfile to your build, then run the flow.

How to extend

• Replace the inline dockerfile with a file checked out from Git.
• Add a Git or schedule trigger so builds run automatically on commits.
• Append a deploy step (GKE, Cloud Run, or Kubernetes) after the push.
• Parameterize the tag with the execution ID or commit SHA for traceability.

Links

• https://kestra.io/plugins/plugin-docker
• https://kestra.io/plugins/plugin-gcp
• https://kestra.io/orchestration/docker