AWS ECR
Deploy applications whose images live in a private Amazon ECR repository. ECR is different from other registries: its registry tokens expire every 12 hours, so a static credential in the vault would stop working half a day later. Instead, the platform's external-secrets operator exchanges a long-lived (narrowly-scoped) IAM credential for a fresh ECR token on a schedule, using the ECRAuthorizationToken generator.
GitHub Container Registry (ghcr.io)
Deploy applications whose images live in a private GitHub Container Registry (ghcr.io) repository. You store a registry credential in your environment's vault once; the platform turns it into a Kubernetes image pull secret that your workloads use automatically.
Docker Hub (docker.io)
Deploy applications whose images live in a private Docker Hub repository. You store a registry credential in your environment's vault once; the platform turns it into a Kubernetes image pull secret that your workloads use automatically.
Quay (quay.io)
Deploy applications whose images live in a private Quay repository. You store a registry credential in your environment's vault once; the platform turns it into a Kubernetes image pull secret that your workloads use automatically.