Try Google Application Default Credentials for GCR (gcr.io) auth

[chanseokoh]

Fixes #1903.

Closes #1500.

ADC from Cloud SDK

Jib can get ADC set through gcloud auth application-default login. ADC in this case are "end user credentials".

WARNING: Your application has authenticated using end user credentials from Google Cloud SDK. We recommend that most server applications use service accounts instead. If your application continues to use end user credentials from Cloud SDK, you might receive a "quota exceeded" or "API not enabled" error. For more information about service accounts, see https://cloud.google.com/docs/authentication/.
[DEBUG] Google ADC found
[DEBUG] Using Google Application Default Credentials for gcr.io
...
[INFO] Built and pushed image as gcr.io/<redacted>/test
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------

ADC from Service Account

The current implementation for a service account is to generate a short-lived OAuth2 access token from the service account and use it for GCR auth.

$ GOOGLE_APPLICATION_CREDENTIALS=my-service-account-key.json mvn -X jib:build
...
[DEBUG] Google ADC found
[DEBUG] ADC is a service account. Set GCS read-write scope
[DEBUG] Using Google Application Default Credentials for gcr.io
...
[INFO] Built and pushed image as gcr.io/<redacted>/test
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------

ADC on Google Cloud Build (GCB)

ADC are available on GCB and have the permission to push to GCR.

[DEBUG] Google ADC found
[DEBUG] Using Google Application Default Credentials for gcr.io
...
[INFO] Built and pushed image as gcr.io/<redacted>/gcb-test
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
...
PUSH
DONE
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

ID                                    CREATE_TIME                DURATION  SOURCE                                                                                             IMAGES  STATUS
0b9e0bb2-3cdb-4e7d-8954-86d5ba0b7e72  2019-08-12T21:08:27+00:00  1M55S     gs://<redacted>_cloudbuild/source/1565644104.23-97f5c662bd70409186821171c3a06db0.tgz  -       SUCCESS

ADC on Google Compute Engine (GCE)

Tested on Linux and Windows:

[DEBUG] Google ADC found
[DEBUG] Using Google Application Default Credentials for gcr.io
...
[INFO] Built and pushed image as gcr.io/<redacted>/adc-gce
[INFO] 
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------

ADC on Google Kubernetes Engine (GKE)

See #1903 for details.

ADC on Cloud Shell

Confirmed it works. However, Cloud Shell has docker-credential-gcloud, docker-credential-gcr, and ~/.docker/config.json, so it's already working pretty well without this ADC support.

[DEBUG] Google ADC found
[DEBUG] Using Google Application Default Credentials for gcr.io

[chanseokoh]

Out of the draft status. Ready for review.

[briandealwis]

I wonder if we should get rid of this method and push knowledge of the docker-credential- prefix to the callers/creators?

[chanseokoh]

Let me take care of this in a separate PR. (#1920)