user
kube_api_server
kms_plugin
external_kms
etcd
Refer to Generate Data Encryption Key (DEK) diagram for details
alt
[Generate DEK at startup]
create/update resource that's to be encrypted
encrypt resource with DEK
store encrypted object
user
kube_api_server
kms_plugin
external_kms
etcd