Change:
kind: EncryptionConfiguration resources: - resources: <del> - secrets </del> <ins> - secrets </ins> providers: <del> - identity: {} - aesgcm: keys: - name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== - name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== - aescbc: keys: - name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== - name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== - secretbox: keys: - name: key1 secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY= </del> <ins> - identity: {} - aesgcm: keys: - name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== - name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== - aescbc: keys: - name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== - name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== - secretbox: keys: - name: key1 secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY= </ins> ``` Each `resources` array item is a separate config and contains a complete configuration. The `resources.resources` field is an array of Kubernetes resource names (`resource` or `resource.group`) that should be encrypted. The `providers` array is an ordered list of the possible encryption <del> providers. Only one provider type may be specified per entry (`identity` or `aescbc` may be provided, but not both in the same item). </del> <ins> providers. </ins> <del> The first provider in the list is used to encrypt resources going into storage. When reading resources from storage each provider that matches the stored data attempts to decrypt the data in order. If no provider can read the stored data due to a mismatch in format or secret key, an error </del> <ins> Only one provider type may be specified per entry (`identity` or `aescbc` may be provided, but not both in the same item). The first provider in the list is used to encrypt resources written into the storage. When reading resources from storage, each provider that matches the stored data attempts in order to decrypt the data. If no provider can read the stored data due to a mismatch in format or secret key, an error </ins> is returned which prevents clients from accessing that resource. <ins> For more detailed information about the `EncryptionConfiguration` struct, please refer to the [encryption configuration API](/docs/reference/config-api/apiserver-encryption.v1/). </ins> {{< caution >}} <del> **IMPORTANT:** If any resource is not readable via the encryption config (because keys were changed), </del> <ins> If any resource is not readable via the encryption config (because keys were changed), </ins> the only recourse is to delete that key from the underlying etcd directly. Calls that attempt to read that resource will fail until it is deleted or a valid decryption key is provided. {{< /caution >}}

Discussion:
This is a Feature Request <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be Within add a new generated page that documents the format for an encryption configuration. Update to hyperlink to that new reference Why is this needed Within , there is a configuration format for the API server, EncryptionConfiguration. At the moment that format is not documented in Readers may want to look up what that format covers. Comments /sig api-machinery /sig auth /kind feature /language en
/triage accepted
/assign This file is already generated in the generator. All we need to do is to copy it to the website repo.