<p>Docker has a mechanism for retrieving Docker registry passwords from a remote store, instead of just storing them in a config file - this mechanism is called a <a href="https://docs.docker.com/engine/reference/commandline/login/#credentials-store" rel="nofollow noreferrer">Credentials Store</a>.  It has a similar mechanism that are used to retrieve a password for a specific registry called <a href="https://docs.docker.com/engine/reference/commandline/login/#credential-helpers" rel="nofollow noreferrer">Credential Helpers</a>.</p>

<p>Basically, it involves defining a value in <code>~/.docker/config.json</code> that is interpreted as the name of an executable.</p>

<pre><code>{
    "credsStore": "osxkeychain"
}
</code></pre>

<p>The value of the <code>credsStore</code> key has a prefix <code>docker-credential-</code> pre-pended to it and if that executable (e.g. <code>docker-credential-osxkeychain</code>) exists on the path then it will be executed and is expected to echo the username and password to <code>stdout</code>, which Docker will use to log in to a private registry. The idea is that the executable reaches out to a store and retrieves your password for you, so you don't have to have lots of files laying around in your cluster with your username/password encoded in them.</p>

<p>I can't get a Kubernetes kubelet to make use of this credential store.  It seems to just ignore it and when Kubernetes attempts to download from a private registry I get a "no basic auth credentials" error.  If I just have a <code>config.json</code> with the username / password in it then kubelet works ok.</p>

<p>Does Kubernetes support Docker credential stores/credential helpers and if so, how do I get them to work?</p>

<p>For reference, kubelet is running through <code>systemd</code>, the credential store executable is on the path and the <code>config.json</code> file is being read.</p>

<p>As of the moment of writing Kubernetes v1.14 does not support credential helpers as per official docs <a href="https://kubernetes.io/docs/concepts/containers/images/#configuring-nodes-to-authenticate-to-a-private-registry" rel="noreferrer">Configuring Nodes to Authenticate to a Private Registry</a></p>

<blockquote>
  <p>Note: Kubernetes as of now only supports the auths and HttpHeaders section of docker config. This means credential helpers (credHelpers or credsStore) are not supported.</p>
</blockquote>
