kubeapiserver
kmsplugin
externalkms
alt
[encrypted local KEK in cache]
[encrypted local KEK not in cache]
alt
[encrypted local KEK is in annotations]
[encrypted local KEK is not in annotations]
decrypt request
{"ciphertext": "<encrypted DEK>", key_id: "<key_id gotten as part of EncryptResponse>",
"annotations": {"kms.kubernetes.io/local-kek": "<encrypted local KEK>"}}
decrypt DEK with local KEK
decrypt local KEK with remote KEK
decrypted local KEK
decrypt DEK with local KEK
cache decrypted local KEK
return decrypt response
{"plaintext": "<decrypted DEK>", key_id: "<remote KEK ID>",
"annotations": {"kms.kubernetes.io/local-kek": "<encrypted local KEK>"}}
decrypt request
{"ciphertext": "<encrypted DEK>", key_id: "<key_id gotten as part of EncryptResponse>",
"annotations": {}}
decrypt DEK with remote KEK (same behavior as today)
decrypted DEK
return decrypt response
{"plaintext": "<decrypted DEK>", key_id: "<remote KEK ID>",
"annotations": {}}
kubeapiserver
kmsplugin
externalkms