1

The instance registers once at the registry and is issued an instance key — returned exactly once.

2

The key is stored in the owner's Key Vault and reaches the pod through the secret driver. It never appears in a repository, a log or a command line.

3

The same key does two jobs: it authenticates the plugin catalogue and it authenticates image pulls from the platform's mirror.

4

Rotation and revocation are actions the owner takes. Revoke it and the instance stops receiving software — nothing else is affected.