kube_api_server
kms_plugin
external_kms
generate DEK
encrypt request
encrypt DEK with remote KEK
encrypted DEK
return encrypt response
{"ciphertext": "<encrypted DEK>", key_id: "<remote KEK ID>", "annotations": {}}
kube_api_server
kms_plugin
external_kms