HashiCorp Ships Public Beta of Vault Kubernetes Key Management
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Vault K8s key management beta is useful for cloud infrastructure security.
HashiCorp shipped a public beta of vault-kube-kms, a KMS v2-compatible plugin that lets Kubernetes clusters use Vault Enterprise as their KMS provider for encryption at rest, offloading envelope encryption to Vault's transit secrets engine. The plugin keeps data encryption keys (DEKs) in Kubernetes while key encryption keys (KEKs) reside in Vault, narrowing the trust boundary by separating key storage from data storage. Deployment requires modifying the EncryptionConfig and kube-apiserver manifest, ruling out fully managed control planes, and demands careful Vault availability planning since the KMS provider sits on the decrypt path.