kube_api_server
kms_plugin
external_kms
Refer to Generate Data Encryption Key (DEK) diagram for details
alt
[Generate DEK at startup]
Refer to Generate Data Encryption Key (DEK) diagram for details
alt
[KEK rotation detected (key_id changed), rotate DEK]
loop
[every minute (or every 10s if error or unhealthy)]
status request
validate remote KEK
KEK status
return status response
{"healthz": "ok", key_id: "<remote KEK ID>", "version": "v2beta1"}
kube_api_server
kms_plugin
external_kms