HashiCorp Debuts Vault as Kubernetes Encryption Key Manager

HashiCorp has moved into public beta with a Kubernetes integration that centralizes encryption key management in Vault Enterprise. The vault-kube-kms plugin, released in July, enables Kubernetes API servers to use Vault as their KMS provider for protecting data at rest in etcd—the distributed database where Kubernetes stores sensitive configuration and secrets.

The Core Problem#

Standard Kubernetes encryption can protect data in etcd, but it creates a trust boundary issue when the same environment that stores sensitive data also holds the keys that unlock it. Platform teams face difficult questions: where are the key encryption keys (KEKs) physically located, who can access them, how often are they rotated, and can usage be audited? Keeping encryption and key control in separate systems addresses this architectural gap.

How It Works#

The plugin preserves Kubernetes' envelope encryption model to avoid performance trade-offs. Kubernetes continues to generate and manage data encryption keys (DEKs) for rapid encrypt/decrypt cycles on the API server. However, those DEK seeds are encrypted using KEKs that Vault controls via its transit secrets engine. The encrypted data and encrypted DEK are stored together in etcd, but decryption becomes impossible without access to a functioning, properly configured Vault instance.

This delegation means Kubernetes handles high-volume cryptographic operations while Vault owns key lifecycle, rotation policies, access controls, and audit trails—a clear separation of responsibilities that appeals to regulated organizations.

Key Benefits#

The integration delivers practical advantages for teams under compliance requirements:

• Centralized key governance through Vault's RBAC and policy engine
• Rotation without data loss — keys can be cycled while maintaining decryption access to existing data
• Audit visibility into key usage, latency, and errors via Vault logs and plugin metrics
• No application changes required

HashiCorp identifies regulated enterprises, multi-cluster production deployments, Red Hat OpenShift environments, and zero-trust infrastructure programs as primary use cases. The company also frames key management as increasingly tied to machine identity—containers, CI/CD systems, and AI agents all need secure, unsupervised access to sensitive resources, making an independent root of trust more critical.