Image pull credentials enforced via ImagePullSecrets or IAM-based registry authentication

A private registry without ImagePullSecrets or IAM-based authentication is either fully open (defeating the purpose of a private registry) or relying on node-level credentials that are shared across all workloads on the node (CWE-522, NIST 800-53 IA-5). Credentials that are never rotated become permanent exfiltration targets — a token from 200 days ago likely has broader permissions than current registry access policies intend. CIS Kubernetes 5.4.1 requires authenticated access to private registries. Workload-level credentials scoped to specific registries and rotated on a schedule are the only defensible model.

Create a registry credential secret and attach it to the relevant ServiceAccount so all pods in the namespace inherit pull credentials automatically. Create the secret:

kubectl create secret docker-registry registry-creds \
  --docker-server=myregistry.example.com \
  --docker-username=ci-puller \
  --docker-password=$(vault read -field=token secret/registry) \
  --namespace=production

Attach to the ServiceAccount in k8s/serviceaccount.yaml:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: production
imagePullSecrets:
  - name: registry-creds

For AWS ECR, use the ECR credential helper or IRSA (IAM Roles for Service Accounts) to eliminate static credentials entirely. Rotate static credentials every 90 days via a scheduled job.