Registry mirror authentication with Kubernetes secrets

2026-03-11

CRI-O credential provider plugins enable Kubernetes to authenticate to private registry mirrors using namespace scoped secrets instead of node level credentials, preserving tenant isolation. The kubelet invokes the plugin during image pulls, which retrieves secrets via service account tokens and generates temporary auth files for CRI-O.