A private image needs somewhere to live and a way for your cluster to pull it. The storage is usually straightforward. Access has a habit of spreading: a credential in CI, a pull Secret in one namespace, another copy when a service moves, and a rotation to remember later. Your existing registry may automate some of that already. We wanted Kupe to take care of it for the clusters it manages.

Kupe now includes an opt-in private container registry for each account. You push images with your usual tools, connect the clusters that need them, and deploy. Connected clusters can pull your images without an imagePullSecrets entry in your manifests. Kupe manages the pull credentials.

The registry belongs to your account

Your images sit alongside the clusters and managed services. Each account can turn on one registry, and you choose which of its clusters to connect.…