Ever wondered why some Kubernetes deployments can pull images from ACR, ECR, or GHCR without any imagePullSecrets in the YAML? In one cluster you need a secret, in another it “just works”—and nobody knows why.

In this talk, I break down what’s really happening behind the scenes when Kubernetes pulls private images across different clouds. We’ll look at how AKS, EKS, and GKE use identities, default service accounts, and mutating webhooks to authenticate without you specifying anything. Then we’ll shift to the multi-cloud reality—where these cloud-specific tricks fall apart.

I’ll share practical patterns for building a clean, cloud-agnostic approach to image pulling: using centralized registries, syncing cloud-native registries, handling secrets at the namespace level, and avoiding hidden behaviors that cause surprises during deployments.

If you’ve ever been confused about how Kubernetes “magically” connects to your container registry—or you’re working across multiple clouds—this session will give you clarity, a mental model that actually makes sense, and a simple architecture you can apply right away.