Allow env vars to skip vendor specific keychain

auth/README.md

@@ -0,0 +1,10 @@
+# auth
+
+## Skipping Vendor Specific Keychains
+
+The auth package has configuration available to skip vendor specific keychain implementations. If you are a platform handling credentials yourself, you may want to skip loading these keychains. This can improve performance as the helpers automatically get invoked based on the hosting environment and the registries being interacted with.
+
+Set any of the following to `true` to skip loading the vendor keychain.
+
+`CNB_REGISTRY_AUTH_KEYCHAIN_SKIP_AMAZON` - set to skip Amazon/AWS's ECR credhelper.
+`CNB_REGISTRY_AUTH_KEYCHAIN_SKIP_AZURE` - set to skip Microsoft/Azure's ACR credhelper

auth/keychain.go

@@ -7,6 +7,7 @@
 	"io"
 	"os"
 	"regexp"
+	"strings"
 
 	ecr "github.com/awslabs/amazon-ecr-credential-helper/ecr-login"
 	"github.com/chrismellard/docker-credential-acr-env/pkg/credhelper"
@@ -18,6 +19,9 @@
 
 const EnvRegistryAuth = "CNB_REGISTRY_AUTH"
 
+// EnvRegistryAuthKeychainSkipFormat is the format string for the environment variable that can be used to skip the keychain for a specific vendor.
+const EnvRegistryAuthKeychainSkipFormat = "CNB_REGISTRY_AUTH_KEYCHAIN_SKIP_%s"
+
 var (
 	amazonKeychain = authn.NewKeychainFromHelper(ecr.NewECRHelper(ecr.WithLogger(io.Discard)))
 	azureKeychain  = authn.NewKeychainFromHelper(credhelper.NewACRCredentialsHelper())
@@ -34,14 +38,25 @@
 		return nil, err
 	}
 
+	keychains := []authn.Keychain{envKeychain, authn.DefaultKeychain}
+
+	if vendorKeychainEnabled("amazon") {
+		keychains = append(keychains, amazonKeychain)
+	}
+	if vendorKeychainEnabled("azure") {
+		keychains = append(keychains, azureKeychain)
+	}
+
 	return authn.NewMultiKeychain(
-		envKeychain,
-		NewResolvedKeychain(authn.DefaultKeychain, images...),
-		NewResolvedKeychain(amazonKeychain, images...),
-		NewResolvedKeychain(azureKeychain, images...),
+		keychains...,
 	), nil
 }
 
+func vendorKeychainEnabled(provider string) bool {
+	providerUpper := strings.ToUpper(provider)
+	return os.Getenv(fmt.Sprintf(EnvRegistryAuthKeychainSkipFormat, providerUpper)) != "true"
+}
+
 // NewEnvKeychain returns an authn.Keychain that uses the provided environment variable as a source of credentials.
 // The value of the environment variable should be a JSON object that maps OCI registry hostnames to Authorization headers.
 func NewEnvKeychain(envVar string) (authn.Keychain, error) {