HashiCorp Ships Public Beta of Vault Kubernetes Key Management
HashiCorp has released a public beta of Vault Kubernetes key management, a KMS v2-compatible plugin that lets the Kubernetes API server delegate envelope encryption to Vault Enterprise, moving the key encryption keys that protect etcd data out of the cluster and into a separately governed trust domain. By Mark Silvester
HashiCorp has released the public beta of Vault Kubernetes key management, a KMS v2-compatible plugin called vault-kube-kms. This new addition allows Kubernetes clusters to use Vault Enterprise as their KMS provider for encryption at rest, offloading envelope encryption to Vault and protecting Kubernetes Secrets and other API resources stored in etcd.
By keeping the standard envelope encryption split, Kubernetes still generates and uses data encryption keys (DEKs) to encrypt sensitive resource data before it is written to etcd, preserving the throughput the API server expects. The DEK seed is protected by key encryption keys (KEKs) held in Vault, where the transit secrets engine performs the cryptographic operations.
This split of duties benefits regulated teams by enabling Kubernetes to handle high-volume encrypt and decrypt calls, while Vault owns key lifecycle, rotation, policy enforcement, and audit.
Brief written by urgent.news from InfoQ's own syndicated text. Machine-written — it may contain errors, so check the original before relying on it.
