configData: `---
kind: CredentialProviderConfig
apiVersion: kubelet.config.k8s.io/v1alpha1
providers:
  - name: test1
    matchImages:
    - "registry.io/one"
    defaultCacheDuration: 10m
    apiVersion: credentialprovider.kubelet.k8s.io/v1alpha1
  - name: test2
    matchImages:
    - "registry.io/two"
    defaultCacheDuration: 10m
    apiVersion: credentialprovider.kubelet.k8s.io/v1alpha1
    args:

		}

		if len(provider.MatchImages) == 0 {
			allErrs = append(allErrs, field.Required(fieldPath.Child("matchImages"), "at least 1 item in matchImages is required"))
		}

		for _, matchImage := range provider.MatchImages {
			if _, err := credentialprovider.ParseSchemelessURL(matchImage); err != nil {

}

func autoConvert_v1alpha1_CredentialProvider_To_config_CredentialProvider(in *v1alpha1.CredentialProvider, out *config.CredentialProvider, s conversion.Scope) error {
	out.Name = in.Name
	out.MatchImages = *(*[]string)(unsafe.Pointer(&in.MatchImages))
	out.DefaultCacheDuration = (*v1.Duration)(unsafe.Pointer(in.DefaultCacheDuration))
	out.APIVersion = in.APIVersion
	out.Args = *(*[]string)(unsafe.Pointer(&in.Args))

		dockerconfig   credentialprovider.DockerConfig
	}{
		{
			name: "exact image match, with Registry cache key",
			pluginProvider: &pluginProvider{
				clock:          tclock,
				lastCachePurge: tclock.Now(),
				matchImages:    []string{"test.registry.io"},
				cache:          cache.NewExpirationStore(cacheKeyFunc, &cacheExpirationPolicy{clock: tclock}),
				plugin: &fakeExecPlugin{
					cacheKeyType: credentialproviderapi.RegistryPluginCacheKeyType,

	return nil
}

func autoConvert_v1_CredentialProvider_To_config_CredentialProvider(in *v1.CredentialProvider, out *config.CredentialProvider, s conversion.Scope) error {
	out.Name = in.Name
	out.MatchImages = *(*[]string)(unsafe.Pointer(&in.MatchImages))
	out.DefaultCacheDuration = (*metav1.Duration)(unsafe.Pointer(in.DefaultCacheDuration))
	out.APIVersion = in.APIVersion
	out.Args = *(*[]string)(unsafe.Pointer(&in.Args))

}

// isImageAllowed returns true if the image matches against the list of allowed matches by the plugin.
func (p *pluginProvider) isImageAllowed(image string) bool {
	for _, matchImage := range p.matchImages {
		if matched, _ := credentialprovider.URLsMatchStr(matchImage, image); matched {
			return true
		}
	}

	return false
}

// getCachedCredentials returns a credentialprovider.DockerConfig if cached from the plugin.

// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *CredentialProvider) DeepCopyInto(out *CredentialProvider) {
	*out = *in
	if in.MatchImages != nil {
		in, out := &in.MatchImages, &out.MatchImages
		*out = make([]string, len(*in))
		copy(*out, *in)
	}
	if in.DefaultCacheDuration != nil {
		in, out := &in.DefaultCacheDuration, &out.DefaultCacheDuration
		*out = new(v1.Duration)

type CredentialProvider struct {
	// name is the required name of the credential provider. It must match the name of the
	// provider executable as seen by the kubelet. The executable must be in the kubelet's
	// bin directory (set by the --credential-provider-bin-dir flag).
	Name string

	// matchImages is a required list of strings used to match against images in order to

}

func autoConvert_v1beta1_CredentialProvider_To_config_CredentialProvider(in *v1beta1.CredentialProvider, out *config.CredentialProvider, s conversion.Scope) error {
	out.Name = in.Name
	out.MatchImages = *(*[]string)(unsafe.Pointer(&in.MatchImages))
	out.DefaultCacheDuration = (*v1.Duration)(unsafe.Pointer(in.DefaultCacheDuration))
	out.APIVersion = in.APIVersion
	out.Args = *(*[]string)(unsafe.Pointer(&in.Args))

API rule violation: list_type_missing,k8s.io/kubelet/config/v1,CredentialProvider,Env
API rule violation: list_type_missing,k8s.io/kubelet/config/v1,CredentialProvider,MatchImages
API rule violation: list_type_missing,k8s.io/kubelet/config/v1,CredentialProviderConfig,Providers
API rule violation: list_type_missing,k8s.io/kubelet/config/v1alpha1,CredentialProvider,Args