According to RKE docs, the kubelet is supposed to handle auth for you - even without the aws cloud provider, but it seems to no longer work. I've been experimenting with tools like this , which I can only get to work in the default namespace (despite the secret getting published in all namespaces). Id like to know what people are doing to manage ECR credentials on 1.31. RKE2?