pluginlifecycle

func AddKMSPluginSidecarToPodSpec ¶

func AddKMSPluginSidecarToPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, encryptionConfigNamespace string, encryptionConfigSecretName string, secretClient corev1client.SecretsGetter, featureGateAccessor featuregates.FeatureGateAccess) error

AddKMSPluginSidecarToPodSpec discovers KMS plugins from the encryption-config secret and injects a sidecar container for each one into the pod spec. It is a no-op when the KMSEncryption feature gate is not enabled or the encryption-config secret does not exist. It uses an uncached client to avoid injecting sidecars based on a stale encryption configuration.