diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md
index 1a9f35b2d2..021d2f840d 100644
--- a/content/en/docs/reference/_index.md
+++ b/content/en/docs/reference/_index.md
@@ -66,6 +66,7 @@ client libraries:
 
 * List of [ports and protocols](/docs/reference/ports-and-protocols/) that
   should be open on control plane and worker nodes
+
 ## Config APIs
 
 This section hosts the documentation for "unpublished" APIs which are used to
@@ -73,12 +74,12 @@ configure  kubernetes components or tools. Most of these APIs are not exposed
 by the API server in a RESTful way though they are essential for a user or an
 operator to use or manage a cluster.
 
-
 * [kube-apiserver configuration (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/)
 * [kube-apiserver configuration (v1)](/docs/reference/config-api/apiserver-config.v1/)
 * [kube-apiserver encryption (v1)](/docs/reference/config-api/apiserver-encryption.v1/)
 * [kubelet configuration (v1alpha1)](/docs/reference/config-api/kubelet-config.v1alpha1/) and
   [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/)
+* [kubelet credential providers (v1alpha1)](/docs/reference/config-api/kubelet-credentialprovider.v1alpha1/)
 * [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) and
   [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/)
 * [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/)
diff --git a/content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md b/content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md
new file mode 100644
index 0000000000..070fe96d09
--- /dev/null
+++ b/content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md
@@ -0,0 +1,192 @@
+---
+title: Kubelet CredentialProvider (v1alpha1)
+content_type: tool-reference
+package: credentialprovider.kubelet.k8s.io/v1alpha1
+auto_generated: true
+---
+
+
+## Resource Types 
+
+
+- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest)
+- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
+  
+    
+
+
+## `CredentialProviderRequest`     {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest}
+    
+
+
+
+
+CredentialProviderRequest includes the image that the kubelet requires authentication for.
+Kubelet will pass this request object to the plugin via stdin. In general, plugins should
+prefer responding with the same apiVersion they were sent.
+
+<table class="table">
+<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
+<tbody>
+    
+<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></td></tr>
+<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderRequest</code></td></tr>
+    
+
+  
+  
+<tr><td><code>image</code> <B>[Required]</B><br/>
+<code>string</code>
+</td>
+<td>
+   image is the container image that is being pulled as part of the
+credential provider plugin request. Plugins may optionally parse the image
+to extract any information required to fetch credentials.</td>
+</tr>
+    
+  
+</tbody>
+</table>
+    
+
+
+## `CredentialProviderResponse`     {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse}
+    
+
+
+
+
+CredentialProviderResponse holds credentials that the kubelet should use for the specified
+image provided in the original request. Kubelet will read the response from the plugin via stdout.
+This response should be set to the same apiVersion as CredentialProviderRequest.
+
+<table class="table">
+<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
+<tbody>
+    
+<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></td></tr>
+<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderResponse</code></td></tr>
+    
+
+  
+  
+<tr><td><code>cacheKeyType</code> <B>[Required]</B><br/>
+<a href="#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType"><code>PluginCacheKeyType</code></a>
+</td>
+<td>
+   cacheKeyType indiciates the type of caching key to use based on the image provided
+in the request. There are three valid values for the cache key type: Image, Registry, and
+Global. If an invalid value is specified, the response will NOT be used by the kubelet.</td>
+</tr>
+    
+  
+<tr><td><code>cacheDuration</code><br/>
+<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
+</td>
+<td>
+   cacheDuration indicates the duration the provided credentials should be cached for.
+The kubelet will use this field to set the in-memory cache duration for credentials
+in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in
+CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.</td>
+</tr>
+    
+  
+<tr><td><code>auth</code><br/>
+<a href="#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig"><code>map[string]k8s.io/kubelet/pkg/apis/credentialprovider/v1alpha1.AuthConfig</code></a>
+</td>
+<td>
+   auth is a map containing authentication information passed into the kubelet.
+Each key is a match image string (more on this below). The corresponding authConfig value
+should be valid for all images that match against this key. A plugin should set
+this field to null if no valid credentials can be returned for the requested image.
+
+Each key in the map is a pattern which can optionally contain a port and a path.
+Globs can be used in the domain, but not in the port or the path. Globs are supported
+as subdomains like '&lowast;.k8s.io' or 'k8s.&lowast;.io', and top-level-domains such as 'k8s.&lowast;'.
+Matching partial subdomains like 'app&lowast;.k8s.io' is also supported. Each glob can only match
+a single subdomain segment, so &lowast;.io does not match &lowast;.k8s.io.
+
+The kubelet will match images against the key when all of the below are true:
+- Both contain the same number of domain parts and each part matches.
+- The URL path of an imageMatch must be a prefix of the target image URL path.
+- If the imageMatch contains a port, then the port must match in the image as well.
+
+When multiple keys are returned, the kubelet will traverse all keys in reverse order so that:
+- longer keys come before shorter keys with the same prefix
+- non-wildcard keys come before wildcard keys with the same prefix.
+
+For any given match, the kubelet will attempt an image pull with the provided credentials,
+stopping after the first successfully authenticated pull.
+
+Example keys:
+  - 123456789.dkr.ecr.us-east-1.amazonaws.com
+  - &lowast;.azurecr.io
+  - gcr.io
+  - &lowast;.&lowast;.registry.io
+  - registry.io:8080/path</td>
+</tr>
+    
+  
+</tbody>
+</table>
+    
+
+
+## `AuthConfig`     {#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig}
+    
+
+
+
+**Appears in:**
+
+- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
+
+
+AuthConfig contains authentication information for a container registry.
+Only username/password based authentication is supported today, but more authentication
+mechanisms may be added in the future.
+
+<table class="table">
+<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
+<tbody>
+    
+
+  
+<tr><td><code>username</code> <B>[Required]</B><br/>
+<code>string</code>
+</td>
+<td>
+   username is the username used for authenticating to the container registry
+An empty username is valid.</td>
+</tr>
+    
+  
+<tr><td><code>password</code> <B>[Required]</B><br/>
+<code>string</code>
+</td>
+<td>
+   password is the password used for authenticating to the container registry
+An empty password is valid.</td>
+</tr>
+    
+  
+</tbody>
+</table>
+    
+
+
+## `PluginCacheKeyType`     {#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType}
+    
+(Alias of `string`)
+
+
+**Appears in:**
+
+- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
+
+
+
+
+
+    
+  
diff --git a/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md b/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md
index b192579970..70e514b473 100644
--- a/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md
+++ b/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md
@@ -152,4 +152,5 @@ Some example values of `matchImages` patterns are:
 
 * Read the details about `CredentialProviderConfig` in the
   [kubelet configuration API (v1alpha1) reference](/docs/reference/config-api/kubelet-config.v1alpha1/).
+* Read the [kubelet credential provider API reference (v1alpha1)](/docs/reference/config-api/kubelet-credentialprovider.v1alpha1/).