only use basic_auth if the repo matches configured docker_repo

internal/provider/resource_ko_image.go

@@ -140,7 +140,7 @@ func (o *buildOptions) makeBuilder(ctx context.Context) (*build.Caching, error)
 
 			kc := authn.DefaultKeychain
 			if o.auth != nil {
-				kc = authn.NewMultiKeychain(staticKeychain{o.auth}, kc)
+				kc = authn.NewMultiKeychain(staticKeychain{o.dockerRepo, o.auth}, kc)
 			}
 			desc, err := remote.Get(ref, remote.WithAuthFromKeychain(kc))
 			if err != nil {
@@ -191,8 +191,12 @@ func doBuild(ctx context.Context, opts buildOptions) (string, error) {
 		return "", fmt.Errorf("build: %v", err)
 	}
 
-	p, err := publish.NewDefault(opts.dockerRepo,
-		publish.WithAuthFromKeychain(authn.DefaultKeychain))
+	kc := authn.DefaultKeychain
+	if opts.auth != nil {
+		kc = authn.NewMultiKeychain(staticKeychain{opts.dockerRepo, opts.auth}, kc)
+	}
+
+	p, err := publish.NewDefault(opts.dockerRepo, publish.WithAuthFromKeychain(kc))
 	if err != nil {
 		return "", fmt.Errorf("NewDefault: %v", err)
 	}
@@ -272,10 +276,20 @@ func resourceKoBuildDelete(ctx context.Context, d *schema.ResourceData, meta int
 	return nil
 }
 
-type staticKeychain struct{ b *authn.Basic }
+type staticKeychain struct {
+	repo string
+	b    *authn.Basic
+}
 
-func (k staticKeychain) Resolve(authn.Resource) (authn.Authenticator, error) {
-	return staticAuthenticator{k.b}, nil
+func (k staticKeychain) Resolve(r authn.Resource) (authn.Authenticator, error) {
+	ref, err := name.ParseReference(k.repo)
+	if err != nil {
+		return nil, err
+	}
+	if r.RegistryStr() == ref.Context().RegistryStr() {
+		return staticAuthenticator{k.b}, nil
+	}
+	return authn.Anonymous, nil
 }
 
 type staticAuthenticator struct{ b *authn.Basic }