mz280: fix harbor authentication

[mzihlmann]

Fixes #280 chainguard-dev/kaniko#184

Description

docker cli auth (default provider) actually handles two credential sources internally. DOCKER_AUTH_CONFIG environment variable and /kaniko/.docker/config.json file. It always gives priority to the environment variable docker/cli#6171. This causes issues where users had read-only credentials for harbor configured instance wide in the environment variable and push credentials stored in the local configfile. Our usage of docker cli would ignore the push credentials and instead fail hard with the readonly credentials.

In a sense this is similar to the issue we had with google credential helper here GoogleContainerTools/kaniko#3328, where we implicitly used invalid credentials to authenticate to gcr, and then failed even though the repository was public. The underlying issue is that if authentication of the highest priority key fails, we just give up, instead we should try out unauthenticated and all keys in order by default, this way credentials can't be shadowed by "higher priority" ones.

As a stop-gap solution to improve the discoverability of these kind of issues we now explicitly log the used credential providers and add an additional warning if DOCKER_AUTH_CONFIG can shadow your other configs.

[mzihlmann]

remember to update the list of issues, as there are quite a few in upstream and chainguard too