introduce the KubeletEnsureSecretImages featuregate

pkg/features/kube_features.go

@@ -345,6 +345,13 @@ const (
 	// fallback to using it's cgroupDriver option.
 	KubeletCgroupDriverFromCRI featuregate.Feature = "KubeletCgroupDriverFromCRI"
 
+	// owner: @stlaz
+	// kep: https://kep.k8s.io/2535
+	//
+	// Enables tracking credentials for image pulls in order to authorize image
+	// access for different tenants.
+	KubeletEnsureSecretPulledImages featuregate.Feature = "KubeletEnsureSecretPulledImages"
+
 	// owner: @vinayakankugoyal
 	// kep: http://kep.k8s.io/2862
 	//

pkg/features/versioned_kube_features.go

@@ -432,6 +432,10 @@ var defaultVersionedKubernetesFeatureGates = map[featuregate.Feature]featuregate
 		{Version: version.MustParse("1.31"), Default: true, PreRelease: featuregate.Beta},
 	},
 
+	KubeletEnsureSecretPulledImages: {
+		{Version: version.MustParse("1.33"), Default: false, PreRelease: featuregate.Alpha},
+	},
+
 	KubeletFineGrainedAuthz: {
 		{Version: version.MustParse("1.32"), Default: false, PreRelease: featuregate.Alpha},
 		{Version: version.MustParse("1.33"), Default: true, PreRelease: featuregate.Beta},

test/compatibility_lifecycle/reference/versioned_feature_list.yaml

@@ -637,6 +637,12 @@
     lockToDefault: false
     preRelease: Alpha
     version: "1.32"
+- name: KubeletEnsureSecretPulledImages
+  versionedSpecs:
+  - default: false
+    lockToDefault: false
+    preRelease: Alpha
+    version: "1.33"
 - name: KubeletFineGrainedAuthz
   versionedSpecs:
   - default: false