Kubernetes Secrets Encryption
Kubernetes Secrets contain sensitive data such as passwords, keys, and certificates. Kubernetes uses a Key Management Service (KMS) encryption provider to encrypt Secrets at rest through envelope encryption, protecting data stored in etcd. Thales Luna HSM secures the key encryption key (KEK) used for this encryption, providing FIPS-validated hardware protection, centralized key lifecycle management, and a comprehensive HSM audit trail for Kubernetes Secrets.
Thales provides two generations of the K8S-KMS-Plugin integration, based on the KMS API version supported by your Kubernetes cluster:
| Guide | KMS API | Status | Kubernetes Support |
|---|---|---|---|
| Kubernetes Secrets Encryption Using KMS v2 | KMS v2 | Current — Recommended for new deployments | Kubernetes v1.29 and later |
| Kubernetes Secrets Encryption Using KMS v1 | KMS v1 | Legacy — For existing deployments only | Kubernetes v1.28 and earlier |
KMS v1 is deprecated as of Kubernetes v1.28 and is disabled by default in Kubernetes v1.29 and later. Use the KMS v2 guide for new deployments and use the KMS v1 guide only for existing deployments that already use the legacy KMS v1 provider.
