--- title: HashiCorp releases public beta of Vault Kubernetes Key... description: HashiCorp has released a public beta of `vault-kube-kms`, a KMSv2-compatible plugin that lets Kubernetes clusters delegate envelope encryption to Vault... canonical: https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HashiCorp releases public beta of Vault Kubernetes Key Management plugin | daily.dev og:description: HashiCorp has released a public beta of `vault-kube-kms`, a KMSv2-compatible plugin that lets Kubernetes clusters delegate envelope encryption to Vault... og:url: https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli og:image: https://api.daily.dev/og/posts/6DKbSKGli.png og:image:alt: HashiCorp releases public beta of Vault Kubernetes Key Management plugin og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HashiCorp releases public beta of Vault Kubernetes Key Management plugin **[Collections](https://daily.dev/sources/collections)** · 2 min read · 5 upvotes · 0 comments ## Summary HashiCorp has released a public beta of `vault-kube-kms`, a KMSv2-compatible plugin that lets Kubernetes clusters delegate envelope encryption to Vault Enterprise. Using the KMSv2 protocol from Kubernetes 1.29, it works with DEK seeds: Kubernetes encrypts data locally, sends the DEK to Vault to be wrapped by a KEK in the transit secrets engine, then caches the seed for local decryption. This reduces network traffic, lowers Vault load, and moves the root of trust outside the cluster. Key limitations include Vault Enterprise being required, incompatibility with managed Kubernetes offerings like EKS, GKE, and AKS, and caution needed around Vault availability affecting cluster decryption. ## Content HashiCorp has released a public beta of [Vault Kubernetes Key Management](https://developer.hashicorp.com/vault), a KMS v2-compatible plugin called `vault-kube-kms` that lets Kubernetes clusters delegate envelope encryption to Vault Enterprise. ## How it works The plugin uses the KMSv2 protocol introduced in Kubernetes 1.29. Rather than routing every encryption and decryption request through Vault, KMSv2 works with DEK seeds: Kubernetes encrypts data locally in memory, sends the data encryption key (DEK) to Vault to be wrapped by a master key encryption key (KEK) stored in Vault's transit secrets engine, then caches the seed at startup for local decryption. This is a meaningful improvement over the legacy KMS model. Network traffic drops significantly, Vault load decreases, and cluster reboots no longer hammer the KMS provider with requests. The root of trust moves outside the cluster, which is the core security benefit. ## Why it matters For regulated environments, this fills a real gap. The setup gives you separation of duties, centralized key lifecycle management, rotation workflows, and audit visibility through Vault - all things that are awkward or impossible when encryption keys live inside the cluster alongside the data they protect. ## Current limitations A few things worth knowing before you get excited: - **Vault Enterprise only.** Open source Vault is not supported. - **Managed Kubernetes control planes are mostly out.** The plugin requires changes to `EncryptionConfig` and the `kube-apiserver` manifest, which rules out EKS, GKE, AKS, and most other fully managed offerings. - **Be careful about the decryption path.** HashiCorp advises caution about placing the KMS provider directly in the decryption path, since a Vault outage at the wrong moment could affect cluster availability. If you run self-managed Kubernetes and already use Vault Enterprise, this is worth evaluating. Everyone else will need to wait for broader support. ## Questions this post answers ### What does the vault-kube-kms plugin do for Kubernetes encryption? It lets Kubernetes clusters delegate envelope encryption to Vault Enterprise using the KMSv2 protocol introduced in Kubernetes 1.29. Kubernetes encrypts data locally with a cached data encryption key seed, while Vault's transit secrets engine wraps that key with a master key encryption key, moving the root of trust outside the cluster and reducing load on the KMS provider. _Teams weighing Vault Enterprise for cluster key management can track rollouts like this one on daily.dev._ ### Does the Vault Kubernetes KMS plugin work with EKS, GKE, or AKS? No, managed Kubernetes control planes are mostly excluded because the plugin requires direct changes to the EncryptionConfig and kube-apiserver manifest, which most fully managed offerings like EKS, GKE, and AKS do not allow. It currently targets self-managed Kubernetes clusters running Vault Enterprise. _Platform engineers deciding between managed and self-managed clusters can follow compatibility updates on daily.dev._ ### Is vault-kube-kms available for open source Vault? No, the plugin currently supports Vault Enterprise only; open source Vault is not supported. HashiCorp also advises caution about placing the KMS provider directly in the decryption path, since a Vault outage at the wrong moment could affect cluster availability. _Security engineers evaluating envelope encryption trade-offs can keep tabs on Vault Enterprise features via daily.dev._ ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-kqhena7w8) · Medium · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#encryption](https://daily.dev/tags/encryption), [#hashicorp](https://daily.dev/tags/hashicorp) [View this post on daily.dev](https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HashiCorp releases public beta of Vault Kubernetes Key Management plugin","url":"https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli"},"datePublished":"2026-08-07T00:08:30.527Z","dateModified":"2026-09-13T19:22:29.105Z","description":"HashiCorp has released a public beta of `vault-kube-kms`, a KMSv2-compatible plugin that lets Kubernetes clusters delegate envelope encryption to Vault...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9aad6ecd64970a9cf198330a461219d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9aad6ecd64970a9cf198330a461219d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,encryption,hashicorp","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"HashiCorp releases public beta of Vault Kubernetes Key Management plugin"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hashicorp-releases-public-beta-of-vault-kubernetes-key-management-plugin-6dkbskgli#faq","mainEntity":[{"@type":"Question","name":"What does the vault-kube-kms plugin do for Kubernetes encryption?","acceptedAnswer":{"@type":"Answer","text":"It lets Kubernetes clusters delegate envelope encryption to Vault Enterprise using the KMSv2 protocol introduced in Kubernetes 1.29. Kubernetes encrypts data locally with a cached data encryption key seed, while Vault's transit secrets engine wraps that key with a master key encryption key, moving the root of trust outside the cluster and reducing load on the KMS provider. Teams weighing Vault Enterprise for cluster key management can track rollouts like this one on daily.dev."}},{"@type":"Question","name":"Does the Vault Kubernetes KMS plugin work with EKS, GKE, or AKS?","acceptedAnswer":{"@type":"Answer","text":"No, managed Kubernetes control planes are mostly excluded because the plugin requires direct changes to the EncryptionConfig and kube-apiserver manifest, which most fully managed offerings like EKS, GKE, and AKS do not allow. It currently targets self-managed Kubernetes clusters running Vault Enterprise. Platform engineers deciding between managed and self-managed clusters can follow compatibility updates on daily.dev."}},{"@type":"Question","name":"Is vault-kube-kms available for open source Vault?","acceptedAnswer":{"@type":"Answer","text":"No, the plugin currently supports Vault Enterprise only; open source Vault is not supported. HashiCorp also advises caution about placing the KMS provider directly in the decryption path, since a Vault outage at the wrong moment could affect cluster availability. Security engineers evaluating envelope encryption trade-offs can keep tabs on Vault Enterprise features via daily.dev."}}]} ```