The Artifact Keeper project, an open-source registry written in Rust, has introduced a new Kubernetes image credential provider. This tool allows clusters to pull private container images without storing static passwords or secrets in namespaces, addressing security risks associated with credential rotation and potential leaks.
The mechanism leverages Kubernetes 1.34+ features, specifically the ability of the kubelet to pass a pod's ServiceAccount token to an external provider. The provider exchanges this token for short-lived, read-only credentials from the registry. This approach aligns with zero-trust principles, as no long-term secrets are stored in manifests.
The provider is a 1.7 MB static binary written in Rust. It performs authentication via OIDC tokens and supports caching to optimize performance. During testing on a kind cluster, 100 consecutive calls to the provider took 1.9 seconds, while 200 parallel calls completed in 1.1 seconds.
Implementation requires specific cluster configurations, including setting up ClusterRoles to allow nodes to request tokens with specific audiences. While the solution is verified on kind, deployment on managed services like EKS, GKE, and AKS involves using privileged DaemonSets or custom scripts to modify kubelet configurations.
The project is currently hosted in a personal repository, with plans to integrate it into the official Artifact Keeper organization. The developer is seeking feedback from users testing the implementation on production cloud environments to refine the tool and documentation.
