PLATFORMS Signal 419
HashiCorp Ships Public Beta of Vault Kubernetes Key Management
↗
Platform teams gain a clearer separation between data encryption and key lifecycle, enabling centralized policy, rotation, and audit of keys via Vault. The change requires Vault Enterprise and edits to the Kubernetes EncryptionConfig and API server manifest, which can limit use on fully managed clusters and adds a dependency on Vault availability for decrypting cluster data.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The vault‑kube‑kms plugin implements the KMS v2 interface, allowing the API server to offload envelope encryption to Vault Enterprise.
Kubernetes continues to generate data‑encryption keys locally, while Vault stores and manages the key‑encryption keys through its transit secrets engine, preserving performance and requiring no code changes.
Deployment is limited to self‑managed clusters with Vault Enterprise and necessitates modifications to the EncryptionConfig and kube‑apiserver manifest, making it unsuitable for most fully managed control planes.
THE CLUSTER