This presentation explores a secure approach to pulling containers in both on-prem and cloud Kubernetes environments without relying on traditionally stored secrets in etcd. By leveraging Kubelet CredentialProvider, YubiKey as a secure key storage, and OAuth-compliant container registries, this session demonstrates how to implement a passwordless authentication mechanism for container pulls.

Attendees will learn how to replace imagePullSecrets with a credential provider that integrates seamlessly with Kubernetes worker nodes. This will ensure a secure, streamlined, and compliant container pull process from any Open Container Initiative-based registry. Through detailed technical explanations and practical examples in Go, this session will provide a deep dive into building and deploying a zero-password authentication workflow for Kubernetes environments, enhancing both security and operational efficiency.