user
kube_api_server
kms_plugin
external_kms
etcd
alt
[Encrypted DEK not in cache]
get/list resource that's encrypted
get encrypted resource
encrypted resource
decrypt request
decrypt DEK with remote KEK
decrypted DEK
return decrypted DEK
cache decrypted DEK
decrypt resource with DEK
return decrypted resource
user
kube_api_server
kms_plugin
external_kms
etcd