HashiCorp Releases Public Beta of Vault Kubernetes Key Management for Encryption at Rest

Vault Kubernetes Key Management Public Beta

HashiCorp announced the public beta of Vault Kubernetes key management on July 10th. This release introduces a KMS v2-compatible plugin, vault-kube-kms, which integrates Vault Enterprise with Kubernetes clusters. The plugin allows Kubernetes to utilize Vault as its Key Management Service (KMS) provider for encryption at rest.

Enhanced Security for Kubernetes Data

The primary function of this integration is to enhance the security of Kubernetes Secrets and other API resources stored in etcd. By offloading envelope encryption to Vault, the keys that protect this sensitive data are moved outside the Kubernetes cluster. This addresses the concern that if the same environment stores sensitive data and controls its encryption keys, the trust boundary remains too narrow.

How the Encryption Process Works

The plugin maintains a standard envelope encryption split. Kubernetes continues to generate and use data encryption keys (DEKs) to encrypt sensitive resource data before writing it to etcd, ensuring expected API server throughput. The DEK seed is protected by key encryption keys (KEKs) held in Vault, where the transit secrets engine performs cryptographic operations. Both the encrypted data and the encrypted DEK are stored together in etcd, making the data undecryptable without a reachable and correctly configured Vault instance.

Benefits for Regulated Environments

This separation of duties offers practical benefits for regulated teams. Kubernetes handles high-volume encrypt and decrypt calls, while Vault manages key lifecycle, rotation, policy enforcement, and auditing. HashiCorp highlights features such as centralized key management, RBAC, rotation workflows that preserve decryption capabilities for existing data, and visibility into key usage, latency, and errors through Vault audit logs and plugin metrics. No application code changes are required for this integration.

Deployment Scenarios and Industry Impact

HashiCorp identifies enterprise Kubernetes platforms like Red Hat OpenShift, multi-cluster production environments, regulated sectors requiring separation of duties, and zero-trust programs as key deployment scenarios. The company views key management as increasingly critical for machine identity, as applications, containers, CI/CD pipelines, infrastructure automation, and AI agents require continuous, human-independent access to sensitive resources, necessitating robust, independently protected key management solutions.