Configure kube-apiserver

Configure the kube-apiserver to use the KMS plugin for data at rest encryption. The changes need to be made in the api-server yaml file '/etc/kubernetes/manifests/kube-apiserver.yaml'.

1. Set the --encryption-provider-config flag on the kube-apiserver to point to the location of the encryption configuration file. Under the command section, add encryption-provider-config=/etc/kubernetes/encryption-config.yaml to enable the use of an external encryption provider.

Highlighted the changes for encryption provider flag addition

2. In the volumeMounts section, add the following entries.

Highlighted the changes for volumeMounts section

3. In the volumes section, add the corresponding volume definitions.

Highlighted the changes for volumes section

4. Save the kube-apiserver yaml file and restart the kube-apiserver.