---
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
    - secrets
    - configmaps
    providers:
{% if microk8s_encryption_kms_socket != "" %}
    - kms:
        apiVersion: v2
        name: aws-encryption-provider
        endpoint: unix://{{ microk8s_encryption_kms_socket }}
        timeout: 3s
{% endif %}
    - aescbc:
        keys:
        - name: k8s-crypto
          secret: {{ microk8s_encryption_secret }}
    - identity: {}