Kubelet CredentialProvider (v1) [page]deterministic
## Resource Types
- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1-CredentialProviderRequest)
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1-CredentialProviderResponse)
## `CredentialProviderRequest` {#credentialprovider-kubelet-k8s-io-v1-CredentialProviderRequest}
<p>CredentialProviderRequest includes the image that the kubelet requires authentication for. Kubelet will pass this request object to the plugin via stdin. In general, plugins should prefer responding with the same apiVersion they were sent.</p>
<table class="table"> <thead><tr><th width="30%">Field</th><th>Description</th></tr></thead> <tbody> <tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1</code></td></tr> <tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderRequest</code></td></tr> <tr><td><code>image</code> <B>[Required]</B><br/> <code>string</code> </td> <td> <p>image is the container image that is being pulled as part of the credential provider plugin request. Plugins may optionally parse the image to extract any information required to fetch credentials.</p> </td> </tr> <tr><td><code>serviceAccountToken</code> <B>[Required]</B><br/> <code>string</code> </td> <td> <p>serviceAccountToken is the service account token bound to the pod for which the image is being pulled. This token is only sent to the plugin if the tokenAttributes.serviceAccountTokenAudience field is configured in the kubelet's credential provider configuration.</p> </td> </tr> <tr><td><code>serviceAccountAnnotations</code> <B>[Required]</B><br/> <code>map[string]string</code> </td> <td> <p>serviceAccountAnnotations is a map of annotations on the service account bound to the pod for which the image is being pulled. The list of annotations in the service account that need to be passed to the plugin is configured in the kubelet's credential provider configuration.</p> </td> </tr> </tbody> </table>
## `CredentialProviderResponse` {#credentialprovider-kubelet-k8s-io-v1-CredentialProviderResponse}
<p>CredentialProviderResponse holds credentials that the kubelet should use for the specified image provided in the original request. Kubelet will read the response from the plugin via stdout. This response should be set to the same apiVersion as CredentialProviderRequest.</p>
<table class="table"> <thead><tr><th width="30%">Field</th><th>Description</th></tr></thead> <tbody> <tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1</code></td></tr> <tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderResponse</code></td></tr> <tr><td><code>cacheKeyType</code> <B>[Required]</B><br/> <a href="#credentialprovider-kubelet-k8s-io-v1-PluginCacheKeyType"><code>PluginCacheKeyType</code></a> </td> <td> <p>cacheKeyType indiciates the type of caching key to use based on the image provided in the request. There are three valid values for the cache key type: Image, Registry, and Global. If an invalid value is specified, the response will NOT be used by the kubelet.</p> </td> </tr> <tr><td><code>cacheDuration</code><br/> <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a> </td> <td> <p>cacheDuration indicates the duration the provided credentials should be cached for. The kubelet will use this field to set the in-memory cache duration for credentials in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.</p> </td> </tr> <tr><td><code>auth</code><br/> <a href="#credentialprovider-kubelet-k8s-io-v1-AuthConfig"><code>map[string]AuthConfig</code></a> </td> <td> <p>auth is a map containing authentication information passed into the kubelet. Each key is a match image string (more on this below). The corresponding authConfig v …(trimmed)