Level Up Your Container Security: Introducing the JFrog Kubelet Credential Provider
No complex CI/CD logic or secret-syncing operators are required; it natively intercepts Kubelet requests.
The plugin automatically fetches and validates the GKE worker node’s underlying Google Cloud Service Account via OIDC.
No. In fact, the plugin settings allow for configurable caching. This ensures that most image pull secret requests are served directly from the Kubelet’s in-memory cache. This provides a significant performance boost by reducing the number of external round-trips to the JFrog Platform and Cloud Identity Provider while keeping credentials securely out of etcd.
Yes, it is ideal for multi-tenant setups because it relies on node-level identity rather than namespace-level secrets.
No, the system is entirely passwordless and relies on short-lived identity tokens.