Vault’s Beta KMS Plugin Lets Kubernetes Offload Encryption to Vault
HashiCorp just opened public beta on vault‑kube‑kms, a KMS‑v2‑compatible plugin that lets the Kubernetes API server delegate envelope encryption to Vault Enterprise. By moving the key‑encryption keys out of etcd into Vault’s trust domain, clusters get centralized key management, auditability and easier key rotation. The feature is ready for any supported Kubernetes version but remains beta‑only.