When pulling images and authentication fails, first try anonymous pull

pkg/skaffold/build/buildpacks/fetcher.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2020 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package buildpacks
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/buildpacks/imgutil"
+	"github.com/buildpacks/imgutil/local"
+
+	"github.com/GoogleContainerTools/skaffold/pkg/skaffold/docker"
+)
+
+type fetcher struct {
+	out    io.Writer
+	docker docker.LocalDaemon
+}
+
+func newFetcher(out io.Writer, docker docker.LocalDaemon) *fetcher {
+	return &fetcher{
+		out:    out,
+		docker: docker,
+	}
+}
+
+func (f *fetcher) Fetch(ctx context.Context, name string, _, pull bool) (imgutil.Image, error) {
+	if pull {
+		if err := f.docker.Pull(ctx, f.out, name); err != nil {
+			return nil, err
+		}
+	}
+
+	image, err := local.NewImage(name, f.docker.RawClient(), local.FromBaseImage(name))
+	if err != nil {
+		return nil, err
+	}
+
+	if !image.Found() {
+		return nil, fmt.Errorf("image %s does not exist on the daemon", name)
+	}
+	return image, nil
+}

pkg/skaffold/build/buildpacks/fetcher_test.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2020 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package buildpacks
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/GoogleContainerTools/skaffold/pkg/skaffold/docker"
+	"github.com/GoogleContainerTools/skaffold/testutil"
+)
+
+func TestFetcher(t *testing.T) {
+	tests := []struct {
+		description    string
+		pull           bool
+		expectedPulled []string
+	}{
+		{
+			description:    "pull",
+			pull:           true,
+			expectedPulled: []string{"image"},
+		},
+		{
+			description:    "don't pull",
+			pull:           false,
+			expectedPulled: nil,
+		},
+	}
+	for _, test := range tests {
+		testutil.Run(t, test.description, func(t *testutil.T) {
+			api := &testutil.FakeAPIClient{}
+			docker := docker.NewLocalDaemon(api, nil, false, nil)
+
+			var out bytes.Buffer
+
+			f := newFetcher(&out, docker)
+			f.Fetch(context.Background(), "image", true, test.pull)
+
+			t.CheckDeepEqual(test.expectedPulled, api.Pulled)
+		})
+	}
+}

pkg/skaffold/build/buildpacks/lifecycle.go

@@ -124,6 +124,7 @@ func runPackBuild(ctx context.Context, out io.Writer, localDocker docker.LocalDa
 	packClient, err := pack.NewClient(
 		pack.WithDockerClient(localDocker.RawClient()),
 		pack.WithLogger(NewLogger(out)),
+		pack.WithFetcher(newFetcher(out, localDocker)),
 	)
 	if err != nil {
 		return fmt.Errorf("unable to create pack client: %w", err)

pkg/skaffold/docker/image.go

@@ -312,13 +312,22 @@ func (l *localDaemon) isAlreadyPushed(ctx context.Context, ref, registryAuth str
 
 // Pull pulls an image reference from a registry.
 func (l *localDaemon) Pull(ctx context.Context, out io.Writer, ref string) error {
+	// Eargerly create credentials.
 	registryAuth, err := l.encodedRegistryAuth(ctx, DefaultAuthHelper, ref)
-	if err != nil {
-		return fmt.Errorf("getting auth config for %q: %w", ref, err)
-	}
+	// Let's ignore the error because maybe the image is public
+	// and can be pulled without credentials.
 
 	rc, err := l.apiClient.ImagePull(ctx, ref, types.ImagePullOptions{
 		RegistryAuth: registryAuth,
+		PrivilegeFunc: func() (string, error) {
+			// The first pull is unauthorized. There are two situations:
+			//   1. if `encodedRegistryAuth()` errored, then `registryAuth == ""` and so we've
+			//     tried an anonymous pull which has failed.  So return the original error from
+			//     `encodedRegistryAuth()`.
+			//   2. If `encodedRegistryAuth()` succeeded (so `err == nil`), then our credential was rejected, so
+			//     return "" to retry as an anonymous pull.
+			return "", err
+		},
 	})
 	if err != nil {
 		return fmt.Errorf("pulling image from repository: %w", err)

testutil/fake_image_api.go

@@ -54,6 +54,7 @@ type FakeAPIClient struct {
 
 	nextImageID int
 	Pushed      map[string]string
+	Pulled      []string
 	Built       []types.ImageBuildOptions
 }
 
@@ -181,7 +182,8 @@ func (f *FakeAPIClient) ImagePush(_ context.Context, ref string, _ types.ImagePu
 	return f.body(digest), nil
 }
 
-func (f *FakeAPIClient) ImagePull(context.Context, string, types.ImagePullOptions) (io.ReadCloser, error) {
+func (f *FakeAPIClient) ImagePull(_ context.Context, ref string, _ types.ImagePullOptions) (io.ReadCloser, error) {
+	f.Pulled = append(f.Pulled, ref)
 	if f.ErrImagePull {
 		return nil, fmt.Errorf("")
 	}