Abstract: A pull request from a managed cluster may be authorized by, for each managed cluster managed by the service provider, generating an encrypted pull secret for a managed cluster, assigning the generated encrypted pull secret to the managed cluster, and responsive to receiving a pull request from a managed cluster at the service provider. The pull request may have an accompanying encrypted pull secret. The pull request may also determine whether the pull request was initiated by an intended managed cluster by decrypting the encrypted pull secret assigned to the managed cluster using a decryption key. The authorizing the pull request based on whether the decrypted pull secret is assigned to an intended managed cluster.