Image builder does not support private container registry when gitpod uses same registry

[princerachit]

Bug description

If gitpod installation contains image pull secret for a registry say myreg.com and user tries to configure the same registry provider to pull private images then gitpod fails to pull the image.
This happens because gitpod tries to use the existing credentials of imagepull secrets rather than the credential provided by the user.

e.g. We have europe-docker.pkg.dev access credentials configured in preview env as part of image pull secret. When I create a project in preview env and use europe-docker.pkg.dev for my private images, gitpod does not use my credentials.

Steps to reproduce

This can be reproduced easily in preview env.

• Create a private google artifact registry in europe region such that the host is europe-docker.pkg.dev.
• Create a service account and give it registry writer permission to your repo.
• Upload an image in your registry.
• Configure your repo with a .gitpod.yml which uses this image.
• Follow steps in Support private registries #8550 description.

The image build will fail.

NOTE: The image build will fail early if the changes of this PR Iare not included in your preview env.

Workspace affected

No response

Expected behavior

Image build should have worked and correct credentials should have been used.

Example repository

No response

Anything else?

No response

[princerachit]

There are a few ways we can solve this problem.

Maintain a list of auths for a registry combining both WORKSPACEKIT_BOBPROXY_AUTH and WORKSPACEKIT_BOBPROXY_ADDITIONALAUTH

Try the next auth in the list if the first one fails. -> This is expensive as their would be multiple calls (as we need to retry)

---

Modify the bob proxy code to maintain two maps

One for Target ref which will use WORKSPACEKIT_BOBPROXY_AUTH and would use WORKSPACEKIT_BOBPROXY_ADDITIONALAUTH only if former doesn't have an entry. Another for Base ref which will WORKSPACEKIT_BOBPROXY_ADDITIONALAUTH and will back to WORKSPACEKIT_BOBPROXY_AUTH only if former does not have an entry.

---

Accept per repo/image auths from user

Fallback to registry level credentials if repo level credential is missing. i.e. do a maximum prefix match against all the keys.

[princerachit]

Reopening this as we reverted the PR.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.