About KMS - External encryption key management | etcd

Overview
- Welcome
- Introduction to OpenShift Container Platform
- Learn more about OpenShift Container Platform
- Kubernetes overview
- OpenShift editions
- Providing documentation feedback
What's new?
- New features and enhancements
- Deprecated features
Architecture
- Architecture overview
- Product architecture
- Installation and update
- Control plane architecture
- Understanding OKD development
- Fedora CoreOS
- Admission plugins
Disconnected environments
- About disconnected environments
- Converting a connected cluster to a disconnected cluster
- About disconnected installation mirroring
- Creating a mirror registry with mirror registry for Red Hat OpenShift
- Mirroring images for a disconnected installation using oc-mirror plugin v2
- Migrating from oc-mirror plugin v1 to v2
- Mirroring images for a disconnected installation using the oc-mirror plugin v1
- Mirroring images for a disconnected installation by using the oc adm command
- Installing a cluster in a disconnected environment
- Using OLM in disconnected environments
- Updating a cluster in a disconnected environment
Installing
- Installation overview
- Installing on Alibaba Cloud
  - Installing a cluster on Alibaba Cloud using the Assisted Installer
- Installing on AWS
- Installing on Azure
- Installing on Azure Stack Hub
- Installing on Google Cloud
- Installing on IBM Cloud
- Installing on Nutanix
- Installing on a single node
  - Preparing to install OpenShift on a single node
  - Installing OpenShift on a single node
- Installing a Two Node OpenShift Cluster
  - Two-Node with Arbiter
  - Two-node with Fencing
- Installing on bare metal
- Installing IBM Cloud Bare Metal (Classic)
  - Prerequisites for IBM Cloud (Classic)
  - Installation workflow for IBM Cloud Bare Metal (Classic)
- Installing on OpenStack
- Installing on Oracle Distributed Cloud
  - Installing a cluster on Oracle Distributed Cloud by using the Assisted Installer
  - Installing a cluster on Oracle Distributed Cloud by using the Agent-based Installer
- Installing on VMware vSphere
- Installing on any platform
  - Installing a cluster on any platform
- Installation configuration
  - Customizing nodes
  - Installation configuration parameters
- Validation and troubleshooting
  - Validating an installation
  - Troubleshooting installation issues
Postinstallation configuration
- Configuring a private cluster
- Cluster tasks
- Node tasks
- Postinstallation network configuration
- Configuring image streams and image registries
- Storage configuration
- Preparing for users
- Changing the cloud provider credentials configuration
- Configuring alert notifications
- Converting a connected cluster to a disconnected cluster
- Day 2 operations for OpenShift Container Platform clusters
Updating clusters
- Updating clusters overview
- Understanding OpenShift updates
  - Introduction to OpenShift updates
  - Understanding OpenShift update duration
- Preparing to update a cluster
- Performing a cluster update
- Troubleshooting a cluster update
  - Gathering data about your cluster update
Support
- Support overview
- Managing your cluster resources
- Remote health monitoring with connected clusters
- Gathering data about your cluster
- Summarizing cluster specifications
- Troubleshooting
Web console
- Web console overview
- Accessing the web console
- Using the OpenShift Container Platform dashboard to get cluster information
- Adding user preferences
- Configuring the web console
- Customizing the web console
- Dynamic plugins
- Disabling the web console
- Creating quick start tutorials
- Optional capabilities and products
CLI tools
- CLI tools overview
- OpenShift CLI (oc)
- OpenShift CLI Manager
- Developer CLI (odo)
- Knative CLI (kn) for use with OpenShift Serverless
- opm CLI
  - Installing the opm CLI
  - opm CLI reference
- Hosted control planes CLI
Security and compliance
- Security and compliance overview
- Container security
- Configuring certificates
- Certificate types and descriptions
- Compliance Operator
- File Integrity Operator
- Security Profiles Operator
- Understanding secrets management
- Viewing audit logs
- Configuring the audit log policy
- Configuring TLS security profiles
- Configuring seccomp profiles
- Allowing JavaScript-based access to the API server from additional hosts
- Scanning pods for vulnerabilities
- Network-Bound Disk Encryption (NBDE)
Authentication and authorization
- Authentication and authorization overview
- Understanding authentication
- Configuring the internal OAuth server
- Configuring OAuth clients
- Managing user-owned OAuth access tokens
- Understanding identity provider configuration
- Configuring identity providers
  - Configuring an htpasswd identity provider
  - Configuring a Keystone identity provider
  - Configuring an LDAP identity provider
  - Configuring a basic authentication identity provider
  - Configuring a request header identity provider
  - Configuring a GitHub or GitHub Enterprise identity provider
  - Configuring a GitLab identity provider
  - Configuring a Google identity provider
  - Configuring an OpenID Connect identity provider
- Enabling direct authentication with an OIDC identity provider
- Configuring advanced direct authentication fields
- Using RBAC to define and apply permissions
- Removing the kubeadmin user
- Understanding and creating service accounts
- Using service accounts in applications
- Using a service account as an OAuth client
- Scoping tokens
- Using bound service account tokens
- Managing security context constraints
- Understanding and managing pod security admission
- Impersonating the system:admin user
- Syncing LDAP groups
- Managing cloud provider credentials
  - About the Cloud Credential Operator
  - Mint mode
  - Passthrough mode
  - Manual mode with long-term credentials for components
  - Manual mode with short-term credentials for components
Networking
- Networking overview
- Networking Operators
- Network Observability Operator
  - Network Observability Operator
- Network security
- Multiple networks
- Hardware networks
- OVN-Kubernetes network plugin
- Ingress and load balancing
- Configuring network settings
- Advanced networking
- Kubernetes NMState
  - Observing and updating node network state and configuration
  - Troubleshooting node network configuration
Storage
- Storage overview
- Understanding ephemeral storage
- Understanding persistent storage
- Configuring persistent storage
- Persistent storage using local storage
- Using Container Storage Interface (CSI)
- Generic ephemeral volumes
- Expanding persistent volumes
- Dynamic provisioning
- Detach volumes after non-graceful node shutdown
Registry
- Registry overview
- Image Registry Operator in OKD
- Setting up and configuring the registry
- Accessing the registry
- Exposing the registry
Operators
- Operators overview
- Understanding Operators
- User tasks
  - Creating applications from installed Operators
  - Installing Operators in your namespace
- Administrator tasks
- Developing Operators
  - Token authentication
- Cluster Operators reference
- OLM v1
  - About OLM v1
Extensions
- Extensions overview
- Architecture
- Common terms
- Catalogs
- Cluster extensions
CI/CD
- CI/CD overview
  - About CI/CD
- Builds using BuildConfig
Images
- Overview of images
- Configuring the Cluster Samples Operator
- Using the Cluster Samples Operator with an alternate registry
- Creating images
- Managing images
- Managing image streams
- Using image streams with Kubernetes resources
- Triggering updates on image stream changes
- Image configuration resources
- Using images
Building applications
- Building applications overview
- Projects
- Creating applications
- Viewing application composition by using the Topology view
- Exporting applications
- Working with Helm charts
- Deployments
- Quotas
  - Resource quotas per project
  - Resource quotas across multiple projects
- Using config maps with applications
- Monitoring project and application metrics using the Developer perspective
- Monitoring application health
- Editing applications
- Pruning objects to reclaim resources
- Idling applications
- Deleting applications
Machine configuration
- Machine configuration overview
- Using machine config objects to configure nodes
- Using node disruption policies to minimize disruption from machine config changes
- Configuring MCO-related custom resources
- Pinning images to nodes
- Boot image management
- Boot image skew enforcement
- Manually updating the boot image
- Creating custom machine config pools
- Managing unused rendered machine configs
- Image mode for OpenShift
- Setting the RHCOS version in a cluster
- Machine Config Daemon metrics
Machine management
- Overview of machine management
- Managing compute machines with the Machine API
- Manually scaling a compute machine set
- Modifying a compute machine set
- Machine phases and lifecycle
- Deleting a machine
- Applying autoscaling to a cluster
- Creating infrastructure machine sets
- Managing user-provisioned infrastructure manually
- Managing control plane machines
- Managing machines with the Cluster API
- Deploying machine health checks
etcd
- Overview of etcd
- Recommended etcd practices
- Ensuring reliable etcd performance and scalability
- Backing up and restoring etcd data
- Enabling etcd encryption
- External encryption key management
- Guidance for clusters that span data centers
Hosted control planes
- Hosted control planes release notes
- Hosted control planes overview
- Preparing to deploy hosted control planes
- Deploying hosted control planes
- Managing hosted control planes
- Deploying hosted control planes in a disconnected environment
- Configuring certificates for hosted control planes
- Updating hosted control planes
- High availability for hosted control planes
- Authentication and authorization for hosted control planes
- Handling machine configuration for hosted control planes
- Using feature gates in a hosted cluster
- Observability for hosted control planes
- Networking for hosted control planes
- Troubleshooting hosted control planes
- Destroying a hosted cluster
- Manually importing a hosted cluster
Nodes
- Overview of nodes
- Working with pods
- Automatically scaling pods with the Custom Metrics Autoscaler Operator
- Controlling pod placement onto nodes (scheduling)
- Using jobs and daemon sets
  - Running background tasks on nodes automatically with daemon sets
  - Running tasks in pods using jobs
- Working with nodes
- Working with containers
- Working with clusters
- Node metrics dashboard
- Manage secure signatures with sigstore
Windows Container Support for OpenShift
- Red Hat OpenShift support for Windows Containers overview
- Release notes
- Understanding Windows container workloads
- Enabling Windows container workloads
- Creating Windows machine sets
- Scheduling Windows container workloads
- Windows node updates
- Using Bring-Your-Own-Host Windows instances as nodes
- Removing Windows nodes
- Disabling Windows container workloads
Observability
- Observability overview
  - About Observability
- Cluster Observability Operator
  - Cluster Observability Operator overview
- Monitoring
  - About OpenShift Container Platform monitoring
- Logging
  - About Logging
- Network Observability
- Power Monitoring
  - About power monitoring
Scalability and performance
- Scalability and performance overview
- Recommended performance and scalability practices
  - Recommended control plane practices
  - Selecting a larger AWS instance type for control plane machines
  - Recommended infrastructure practices
- Telco core reference design specifications
- Telco RAN DU reference design specifications
- Telco hub reference design specifications
- Comparing cluster configurations
  - Understanding the cluster-compare plugin
  - Installing the cluster-compare plugin
  - Using the cluster-compare plugin
  - Creating a reference configuration
  - Performing advanced reference configuration customization
  - Troubleshooting cluster comparisons
- Planning your environment according to object maximums
- Compute Resource Quotas
- Using the Node Tuning Operator
- Using CPU Manager and Topology Manager
- Scheduling NUMA-aware workloads
- Scalability and performance optimization
  - Optimizing storage
  - Optimizing routing
  - Optimizing networking
  - Optimizing CPU usage
- Managing bare metal hosts
- Optimizing memory management for workloads by using huge pages
- Understanding low latency
- Tuning nodes for low latency with the performance profile
- Tuning hosted control planes for low latency with the performance profile
- Provisioning real-time and low latency workloads
- Debugging low latency tuning
- Performing latency tests for platform verification
- Improving cluster stability in high latency environments using worker latency profiles
- Workload partitioning
- Using the Node Observability Operator
Edge computing
- Challenges of the network far edge
- Preparing the hub cluster for ZTP
- Updating GitOps ZTP
- Installing managed clusters with RHACM and ClusterInstance resources
- Manually installing a single-node OpenShift cluster with GitOps ZTP
- Migrating from SiteConfig CRs to ClusterInstance CRs
- Recommended single-node OpenShift cluster configuration for vDU application workloads
- Validating cluster tuning for vDU application workloads
- Advanced managed cluster configuration with ClusterInstance resources
- Managing cluster policies with PolicyGenerator resources
- Managing cluster policies with PolicyGenTemplate resources
- Using hub templates in PolicyGenerator or PolicyGenTemplate CRs
- Updating managed clusters with the Topology Aware Lifecycle Manager
- Expanding single-node OpenShift clusters with GitOps ZTP
- Pre-caching images for single-node OpenShift deployments
- Image-based upgrade for single-node OpenShift clusters
- Image-based installation for single-node OpenShift
- Network reconfiguration for single-node OpenShift
Specialized hardware and driver enablement
- About specialized hardware and driver enablement
- Driver Toolkit
- Node Feature Discovery Operator
- Kernel Module Management Operator
- Kernel Module Management Operator release notes
Hardware accelerators
- About hardware accelerators
- NVIDIA GPU architecture
- AMD GPU Operator
- Intel Gaudi AI accelerators
- Remote Direct Memory Access (RDMA)
Backup and restore
- Overview of backup and restore operations
- Shutting down a cluster gracefully
- Restarting a cluster gracefully
- Hibernating a cluster
- OADP Application backup and restore
- Control plane backup and restore
Migrating from version 3 to 4
- Migrating from version 3 to 4 overview
- About migrating from OKD 3 to 4
- Differences between OKD 3 and 4
- Network considerations
API reference
- API overview
  - Understanding API tiers
  - API compatibility guidelines
  - Editing kubelet log level verbosity and gathering logs
  - API list
- Common object reference
  - Index
- Authorization APIs
  - About Authorization APIs
  - LocalResourceAccessReview [authorization.openshift.io/v1]
  - LocalSubjectAccessReview [authorization.openshift.io/v1]
  - ResourceAccessReview [authorization.openshift.io/v1]
  - SelfSubjectRulesReview [authorization.openshift.io/v1]
  - SubjectAccessReview [authorization.openshift.io/v1]
  - SubjectRulesReview [authorization.openshift.io/v1]
  - SelfSubjectReview [authentication.k8s.io/v1]
  - TokenRequest [authentication.k8s.io/v1]
  - TokenReview [authentication.k8s.io/v1]
  - LocalSubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectRulesReview [authorization.k8s.io/v1]
  - SubjectAccessReview [authorization.k8s.io/v1]
- Autoscale APIs
  - About Autoscale APIs
  - ClusterAutoscaler [autoscaling.openshift.io/v1]
  - MachineAutoscaler [autoscaling.openshift.io/v1beta1]
  - HorizontalPodAutoscaler [autoscaling/v2]
  - Scale [autoscaling/v1]
- Config APIs
  - About Config APIs
  - APIServer [config.openshift.io/v1]
  - Authentication [config.openshift.io/v1]
  - Build [config.openshift.io/v1]
  - ClusterImagePolicy [config.openshift.io/v1]
  - ClusterOperator [config.openshift.io/v1]
  - ClusterVersion [config.openshift.io/v1]
  - Console [config.openshift.io/v1]
  - DNS [config.openshift.io/v1]
  - FeatureGate [config.openshift.io/v1]
  - HelmChartRepository [helm.openshift.io/v1beta1]
  - Image [config.openshift.io/v1]
  - ImageDigestMirrorSet [config.openshift.io/v1]
  - ImageContentPolicy [config.openshift.io/v1]
  - ImagePolicy [config.openshift.io/v1]
  - ImageTagMirrorSet [config.openshift.io/v1]
  - InsightsDataGather [config.openshift.io/v1]
  - Infrastructure [config.openshift.io/v1]
  - Ingress [config.openshift.io/v1]
  - Network [config.openshift.io/v1]
  - Node [config.openshift.io/v1]
  - OAuth [config.openshift.io/v1]
  - OperatorHub [config.openshift.io/v1]
  - Project [config.openshift.io/v1]
  - ProjectHelmChartRepository [helm.openshift.io/v1beta1]
  - Proxy [config.openshift.io/v1]
  - Scheduler [config.openshift.io/v1]
- Console APIs
  - About Console APIs
  - ConsoleCLIDownload [console.openshift.io/v1]
  - ConsoleExternalLogLink [console.openshift.io/v1]
  - ConsoleLink [console.openshift.io/v1]
  - ConsoleNotification [console.openshift.io/v1]
  - ConsolePlugin [console.openshift.io/v1]
  - ConsoleQuickStart [console.openshift.io/v1]
  - ConsoleSample [console.openshift.io/v1]
  - ConsoleYAMLSample [console.openshift.io/v1]
- Extension APIs
  - About Extension APIs
  - APIService [apiregistration.k8s.io/v1]
  - CustomResourceDefinition [apiextensions.k8s.io/v1]
  - MutatingWebhookConfiguration [admissionregistration.k8s.io/v1]
  - TestExtensionAdmission [testextension.redhat.io/v1]
  - ValidatingAdmissionPolicy [admissionregistration.k8s.io/v1]
  - ValidatingAdmissionPolicyBinding [admissionregistration.k8s.io/v1]
  - ValidatingWebhookConfiguration [admissionregistration.k8s.io/v1]
- Image APIs
  - About Image APIs
  - Image [image.openshift.io/v1]
  - ImageSignature [image.openshift.io/v1]
  - ImageStreamImage [image.openshift.io/v1]
  - ImageStreamImport [image.openshift.io/v1]
  - ImageStreamLayers [image.openshift.io/v1]
  - ImageStreamMapping [image.openshift.io/v1]
  - ImageStream [image.openshift.io/v1]
  - ImageStreamTag [image.openshift.io/v1]
  - ImageTag [image.openshift.io/v1]
  - SecretList [image.openshift.io/v1]
- Machine APIs
  - About Machine APIs
  - ContainerRuntimeConfig [machineconfiguration.openshift.io/v1]
  - ControllerConfig [machineconfiguration.openshift.io/v1]
  - ControlPlaneMachineSet [machine.openshift.io/v1]
  - KubeletConfig [machineconfiguration.openshift.io/v1]
  - MachineConfig [machineconfiguration.openshift.io/v1]
  - MachineConfigPool [machineconfiguration.openshift.io/v1]
  - MachineHealthCheck [machine.openshift.io/v1beta1]
  - Machine [machine.openshift.io/v1beta1]
  - MachineSet [machine.openshift.io/v1beta1]
  - MachineConfigNode [machineconfiguration.openshift.io/v1]
  - MachineOSBuild [machineconfiguration.openshift.io/v1]
  - MachineOSConfig [machineconfiguration.openshift.io/v1]
  - PinnedImageSet [machineconfiguration.openshift.io/v1]
- Metadata APIs
  - About Metadata APIs
  - APIRequestCount [apiserver.openshift.io/v1]
  - Binding [undefined/v1]
  - ComponentStatus [undefined/v1]
  - ConfigMap [undefined/v1]
  - ControllerRevision [apps/v1]
  - Event [events.k8s.io/v1]
  - Event [undefined/v1]
  - Lease [coordination.k8s.io/v1]
  - Namespace [undefined/v1]
- Monitoring APIs
  - About Monitoring APIs
  - Alertmanager [monitoring.coreos.com/v1]
  - AlertmanagerConfig [monitoring.coreos.com/v1beta1]
  - AlertRelabelConfig [monitoring.openshift.io/v1]
  - AlertingRule [monitoring.openshift.io/v1]
  - DataGather [insights.openshift.io/v1]
  - PodMonitor [monitoring.coreos.com/v1]
  - Probe [monitoring.coreos.com/v1]
  - Prometheus [monitoring.coreos.com/v1]
  - PrometheusRule [monitoring.coreos.com/v1]
  - ServiceMonitor [monitoring.coreos.com/v1]
  - ThanosRuler [monitoring.coreos.com/v1]
  - NodeMetrics [metrics.k8s.io/v1beta1]
  - PodMetrics [metrics.k8s.io/v1beta1]
- Network APIs
  - About Network APIs
  - ClusterUserDefinedNetwork [k8s.ovn.org/v1]
  - AdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
  - AdminPolicyBasedExternalRoute [k8s.ovn.org/v1]
  - BackendTLSPolicy [gateway.networking.k8s.io/v1]
  - BaselineAdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
  - CloudPrivateIPConfig [cloud.network.openshift.io/v1]
  - EgressFirewall [k8s.ovn.org/v1]
  - EgressIP [k8s.ovn.org/v1]
  - EgressQoS [k8s.ovn.org/v1]
  - EgressService [k8s.ovn.org/v1]
  - Endpoints [undefined/v1]
  - EndpointSlice [discovery.k8s.io/v1]
  - EgressRouter [network.operator.openshift.io/v1]
  - GRPCRoute [gateway.networking.k8s.io/v1]
  - Gateway [gateway.networking.k8s.io/v1]
  - GatewayClass [gateway.networking.k8s.io/v1]
  - HTTPRoute [gateway.networking.k8s.io/v1]
  - Ingress [networking.k8s.io/v1]
  - IngressClass [networking.k8s.io/v1]
  - IPAddress [networking.k8s.io/v1]
  - IPAMClaim [k8s.cni.cncf.io/v1alpha1]
  - IPPool [whereabouts.cni.cncf.io/v1alpha1]
  - MultiNetworkPolicy [k8s.cni.cncf.io/v1beta1]
  - NetworkAttachmentDefinition [k8s.cni.cncf.io/v1]
  - NetworkPolicy [networking.k8s.io/v1]
  - NodeSlicePool [whereabouts.cni.cncf.io/v1alpha1]
  - OverlappingRangeIPReservation [whereabouts.cni.cncf.io/v1alpha1]
  - PodNetworkConnectivityCheck [controlplane.operator.openshift.io/v1alpha1]
  - ReferenceGrant [gateway.networking.k8s.io/v1beta1]
  - Route [route.openshift.io/v1]
  - Service [undefined/v1]
  - ServiceCIDR [networking.k8s.io/v1]
  - IPAddressClaim [ipam.cluster.x-k8s.io/v1beta1]
  - UserDefinedNetwork [k8s.ovn.org/v1]
- Node APIs
  - About Node APIs
  - Node [undefined/v1]
  - PerformanceProfile [performance.openshift.io/v2]
  - Profile [tuned.openshift.io/v1]
  - RuntimeClass [node.k8s.io/v1]
  - Tuned [tuned.openshift.io/v1]
- OAuth APIs
  - About OAuth APIs
  - OAuthAccessToken [oauth.openshift.io/v1]
  - OAuthAuthorizeToken [oauth.openshift.io/v1]
  - OAuthClientAuthorization [oauth.openshift.io/v1]
  - OAuthClient [oauth.openshift.io/v1]
  - UserOAuthAccessToken [oauth.openshift.io/v1]
- Operator APIs
  - About Operator APIs
  - Authentication [operator.openshift.io/v1]
  - CloudCredential [operator.openshift.io/v1]
  - ClusterCSIDriver [operator.openshift.io/v1]
  - Console [operator.openshift.io/v1]
  - Config [operator.openshift.io/v1]
  - Config [imageregistry.operator.openshift.io/v1]
  - Config [samples.operator.openshift.io/v1]
  - CSISnapshotController [operator.openshift.io/v1]
  - DNS [operator.openshift.io/v1]
  - DNSRecord [ingress.operator.openshift.io/v1]
  - Etcd [operator.openshift.io/v1]
  - ImageContentSourcePolicy [operator.openshift.io/v1alpha1]
  - ImagePruner [imageregistry.operator.openshift.io/v1]
  - IngressController [operator.openshift.io/v1]
  - InsightsOperator [operator.openshift.io/v1]
  - KubeAPIServer [operator.openshift.io/v1]
  - KubeControllerManager [operator.openshift.io/v1]
  - KubeScheduler [operator.openshift.io/v1]
  - KubeStorageVersionMigrator [operator.openshift.io/v1]
  - MachineConfiguration [operator.openshift.io/v1]
  - Network [operator.openshift.io/v1]
  - OpenShiftAPIServer [operator.openshift.io/v1]
  - OpenShiftControllerManager [operator.openshift.io/v1]
  - OperatorPKI [network.operator.openshift.io/v1]
  - ServiceCA [operator.openshift.io/v1]
  - Storage [operator.openshift.io/v1]
- OperatorHub APIs
  - About OperatorHub APIs
  - CatalogSource [operators.coreos.com/v1alpha1]
  - ClusterCatalog [olm.operatorframework.io/v1]
  - ClusterExtension [olm.operatorframework.io/v1]
  - ClusterServiceVersion [operators.coreos.com/v1alpha1]
  - InstallPlan [operators.coreos.com/v1alpha1]
  - OLM [operator.openshift.io/v1]
  - OLMConfig [operators.coreos.com/v1]
  - Operator [operators.coreos.com/v1]
  - OperatorCondition [operators.coreos.com/v2]
  - OperatorGroup [operators.coreos.com/v1]
  - PackageManifest [packages.operators.coreos.com/v1]
  - Subscription [operators.coreos.com/v1alpha1]
- Policy APIs
  - About Policy APIs
  - Eviction [policy/v1]
  - PodDisruptionBudget [policy/v1]
- Project APIs
  - About Project APIs
  - Project [project.openshift.io/v1]
  - ProjectRequest [project.openshift.io/v1]
- Provisioning APIs
  - About Provisioning APIs
  - BMCEventSubscription [metal3.io/v1alpha1]
  - BareMetalHost [metal3.io/v1alpha1]
  - DataImage [metal3.io/v1alpha1]
  - FirmwareSchema [metal3.io/v1alpha1]
  - HardwareData [metal3.io/v1alpha1]
  - HostFirmwareComponents [metal3.io/v1alpha1]
  - HostFirmwareSettings [metal3.io/v1alpha1]
  - HostUpdatePolicy [metal3.io/v1alpha1]
  - Metal3Remediation [infrastructure.cluster.x-k8s.io/v1beta1]
  - Metal3RemediationTemplate [infrastructure.cluster.x-k8s.io/v1beta1]
  - PreprovisioningImage [metal3.io/v1alpha1]
  - Provisioning [metal3.io/v1alpha1]
- RBAC APIs
  - About RBAC APIs
  - ClusterRoleBinding [rbac.authorization.k8s.io/v1]
  - ClusterRole [rbac.authorization.k8s.io/v1]
  - RoleBinding [rbac.authorization.k8s.io/v1]
  - Role [rbac.authorization.k8s.io/v1]
- Role APIs
  - About Role APIs
  - ClusterRoleBinding [authorization.openshift.io/v1]
  - ClusterRole [authorization.openshift.io/v1]
  - RoleBindingRestriction [authorization.openshift.io/v1]
  - RoleBinding [authorization.openshift.io/v1]
  - Role [authorization.openshift.io/v1]
- Schedule and quota APIs
  - About Schedule and quota APIs
  - AppliedClusterResourceQuota [quota.openshift.io/v1]
  - ClusterResourceQuota [quota.openshift.io/v1]
  - DeviceClass [resource.k8s.io/v1]
  - FlowSchema [flowcontrol.apiserver.k8s.io/v1]
  - LimitRange [undefined/v1]
  - PriorityClass [scheduling.k8s.io/v1]
  - PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1]
  - ResourceQuota [undefined/v1]
  - ResourceClaim [resource.k8s.io/v1]
  - ResourceClaimTemplate [resource.k8s.io/v1]
  - ResourceSlice [resource.k8s.io/v1]
- Security APIs
  - About Security APIs
  - CertificateSigningRequest [certificates.k8s.io/v1]
  - CredentialsRequest [cloudcredential.openshift.io/v1]
  - PodSecurityPolicyReview [security.openshift.io/v1]
  - PodSecurityPolicySelfSubjectReview [security.openshift.io/v1]
  - PodSecurityPolicySubjectReview [security.openshift.io/v1]
  - RangeAllocation [security.openshift.io/v1]
  - Secret [undefined/v1]
  - SecurityContextConstraints [security.openshift.io/v1]
  - ServiceAccount [undefined/v1]
- Storage APIs
  - About Storage APIs
  - CSIDriver [storage.k8s.io/v1]
  - CSINode [storage.k8s.io/v1]
  - CSIStorageCapacity [storage.k8s.io/v1]
  - PersistentVolume [undefined/v1]
  - PersistentVolumeClaim [undefined/v1]
  - StorageClass [storage.k8s.io/v1]
  - StorageState [migration.k8s.io/v1alpha1]
  - StorageVersionMigration [migration.k8s.io/v1alpha1]
  - VolumeAttachment [storage.k8s.io/v1]
  - VolumeAttributesClass [storage.k8s.io/v1]
  - VolumePopulator [populator.storage.k8s.io/v1beta1]
  - VolumeSnapshot [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotClass [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotContent [snapshot.storage.k8s.io/v1]
- Template APIs
  - About Template APIs
  - BrokerTemplateInstance [template.openshift.io/v1]
  - PodTemplate [undefined/v1]
  - Template [template.openshift.io/v1]
  - TemplateInstance [template.openshift.io/v1]
- User and group APIs
  - About User and group APIs
  - Group [user.openshift.io/v1]
  - Identity [user.openshift.io/v1]
  - UserIdentityMapping [user.openshift.io/v1]
  - User [user.openshift.io/v1]
- Workloads APIs
  - About Workloads APIs
  - BuildConfig [build.openshift.io/v1]
  - Build [build.openshift.io/v1]
  - BuildLog [build.openshift.io/v1]
  - BuildRequest [build.openshift.io/v1]
  - CronJob [batch/v1]
  - DaemonSet [apps/v1]
  - Deployment [apps/v1]
  - DeploymentConfig [apps.openshift.io/v1]
  - DeploymentConfigRollback [apps.openshift.io/v1]
  - DeploymentLog [apps.openshift.io/v1]
  - DeploymentRequest [apps.openshift.io/v1]
  - Job [batch/v1]
  - Pod [undefined/v1]
  - ReplicationController [undefined/v1]
  - ReplicaSet [apps/v1]
  - StatefulSet [apps/v1]
Virtualization
- About
- Getting started
  - Getting started with OKD Virtualization
- Installing
- Postinstallation configuration
- Updating
  - Updating OKD Virtualization
- Creating a virtual machine
- Advanced VM creation
- Managing VMs
- Networking
- Storage
- Live migration
- Nodes
- Monitoring
- Support
  - Support overview
  - Troubleshooting
- Backup and restore
AI applications
- MCP server
  - MCP server overview

About Kubernetes KMS v2 encryption
- Encrypted resources
KMS Technology Preview limitations
- Current limitations
Additional resources

You can configure Kubernetes Key Management Service (KMS) v2 on OKD to centralize encryption key management and meet regulatory compliance requirements.

Kubernetes KMS v2 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

About Kubernetes KMS v2 encryption

Kubernetes KMS v2 uses external Key Management Services to encrypt etcd data and centralize key management.

Kubernetes KMS v2 provides:

Customer-managed encryption keys that never leave the external KMS
Centralized key management and auditing
Regulatory compliance support

Encrypted resources

When you enable KMS encryption, OKD encrypts the following sensitive resources in etcd:

Secrets
ConfigMaps
Routes
OAuth access tokens
OAuth authorize tokens

Resource types, namespaces, and object names are not encrypted.

Additional resources

Using a KMS provider for data encryption

KMS Technology Preview limitations

Review the current limitations of Kubernetes KMS v2 to plan deployments and avoid unsupported configurations in OKD 4.21 or later.

Current limitations

Plugins require manual installation on each control plane node
Plugins must listen at unix:///var/run/kmsplugin/kms.sock
Only one KMS plugin can run at a time
KMS-to-KMS migration requires intermediate migration to identity or aescbc