etcd
kubeapiserver
kmsplugin
externalkms
alt
[using key hierarchy]
[not using key hierarchy]
encrypt request
encrypt DEK with local KEK
encrypt local KEK with remote KEK
encrypted local KEK
cache encrypted local KEK
return encrypt response
{"ciphertext": "<encrypted DEK>", key_id: "<remote KEK ID>",
"annotations": {"kms.kubernetes.io/local-kek": "<encrypted local KEK>"}}
encrypt DEK with remote KEK
encrypted DEK
return encrypt response
{"ciphertext": "<encrypted DEK>", key_id: "<remote KEK ID>", "annotations": {}}
store encrypt response and encrypted DEK
etcd
kubeapiserver
kmsplugin
externalkms