Check docker config auths for repo and registry

[imjasonh]

This enables the case where a config's auth section can specify different auth per repository within the same registry.

This seems to be the root cause of GoogleContainerTools/kaniko#687

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 73.99%. Comparing base (33725d2) to head (66f8c7b).
Report is 261 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1280      +/-   ##
==========================================
- Coverage   74.01%   73.99%   -0.02%     
==========================================
  Files         112      112              
  Lines        8374     8396      +22     
==========================================
+ Hits         6198     6213      +15     
- Misses       1573     1580       +7     
  Partials      603      603              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jonjohnsonjr]

I'm a bit reluctant to diverge from docker's behavior -- do they support anything like this? Does the red hat stuff?

[jonjohnsonjr]

Related FR: docker/cli#2928

[imjasonh]

Oh, I incorrectly thought this was already how Docker worked 😢

I'll close this, and point folks up to that FR. Thanks!

[imjasonh]

Sounds like Podman supports per-registry auths: GoogleContainerTools/kaniko#687 (comment)

wdyt?

[jonjohnsonjr]

wdyt?

I think ideally we could upstream this to docker/cli?

[imjasonh]

I think ideally we could upstream this to docker/cli?

I'm willing to try. I think we might have a better case if we can say Podman, and all tools using authn.DefaultKeychain have this behavior. Want me to merge and update all these tools with this behavior? I know Tekton has expressed interest in supporting this before.

[jonjohnsonjr]

I'm a little bit worried that we'll hit a new error here but it looks like it currently never returns an error so it's probably fine:

https://github.com/docker/cli/blob/25eee83d6b8c475548254b2decc9c8e0490d229c/cli/config/configfile/file.go#L321
https://github.com/docker/cli/blob/25eee83d6b8c475548254b2decc9c8e0490d229c/cli/config/configfile/file.go#L311
https://github.com/docker/cli/blob/25eee83d6b8c475548254b2decc9c8e0490d229c/cli/config/credentials/file_store.go#L32-L47