load creds for provider repo by default (#236)

since `repo` became a provider scoped resource, we now have a consistent
`Repo` that we can use to always plumb through some set of default
credentials to the harness, without requiring the use of defining custom
provider scoped overrides.

for all but the most advanced cases, this means users no longer need to
specify harness scoped credentials.

internal/provider/harness_docker_resource.go

@@ -195,6 +195,16 @@ func (r *HarnessDockerResource) harness(ctx context.Context, data *HarnessDocker
 		}
 	}
 
+	// always ensure the provider scoped repository plumbs credentials through
+	if r.store.providerResourceData.Repo.ValueString() != "" {
+		ref, err := name.ParseReference(r.store.providerResourceData.Repo.ValueString())
+		if err != nil {
+			return nil, []diag.Diagnostic{diag.NewErrorDiagnostic("invalid repository reference", fmt.Sprintf("invalid repository reference: %s", err))}
+		}
+
+		opts = append(opts, docker.WithAuthFromKeychain(ref.Context().RegistryStr()))
+	}
+
 	b, err := r.bundler(data)
 	if err != nil {
 		return nil, []diag.Diagnostic{diag.NewErrorDiagnostic("failed to create bundler", err.Error())}

internal/provider/harness_k3s_resource.go

@@ -225,6 +225,16 @@ func (r *HarnessK3sResource) harness(ctx context.Context, data *HarnessK3sResour
 	}
 	kopts = append(kopts, k3s.WithNetworks(networks...))
 
+	// always ensure the provider scoped repository plumbs credentials through
+	if r.store.providerResourceData.Repo.ValueString() != "" {
+		ref, err := name.ParseReference(r.store.providerResourceData.Repo.ValueString())
+		if err != nil {
+			return nil, []diag.Diagnostic{diag.NewErrorDiagnostic("invalid repository reference", fmt.Sprintf("invalid repository reference: %s", err))}
+		}
+
+		kopts = append(kopts, k3s.WithAuthFromKeychain(ref.Context().RegistryStr()))
+	}
+
 	bref, err := b.Bundle(ctx, r.store.repo, ls...)
 	if err != nil {
 		return nil, []diag.Diagnostic{diag.NewErrorDiagnostic("failed to bundle image", err.Error())}