Google Kubernetes Engine (GKE)

Integration between GKE and JFrog Artifactory utilizes native Google Cloud service accounts for secure, secretless container image pulls.

GKE Features

JFrog's GKE Solution

Related Resources
Blog

Level Up Your Container Security: Introducing the JFrog Kubelet Credential Provider

GKE FAQs

Do I need a secret-syncing operator to use this with GKE?

No complex CI/CD logic or secret-syncing operators are required; it natively intercepts Kubelet requests.

How does Artifactory know which GKE node is requesting the image?

The plugin automatically fetches and validates the GKE worker node’s underlying Google Cloud  Service Account via OIDC.

Will this slow down my image pulls?

No. In fact, the plugin settings allow for configurable caching. This ensures that most image pull secret requests are served directly from the Kubelet’s in-memory cache. This provides a significant performance boost by reducing the number of external round-trips to the JFrog Platform and Cloud Identity Provider while keeping credentials securely out of etcd.

Is this suitable for multi-tenant GKE clusters?

Yes, it is ideal for multi-tenant setups because it relies on node-level identity rather than namespace-level secrets.

Are any credentials stored in Google Cloud Secret Manager?

No, the system is entirely passwordless and relies on short-lived identity tokens.

Trusted Releases Built For Speed

GKE

Google Kubernetes Engine (GKE) is a managed Kubernetes service for deploying containerized applications on Google Cloud.