<p>I am trying to configure the <code>kube-apiserver</code> so that it uses encryption to configure secrets in my minikube cluster.</p>

<p>For that, I have followed the <a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#encrypting-your-data" rel="nofollow noreferrer">documentation on kubernetes.io</a> but got stuck at step 3 that says</p>

<p><em>Set the <code>--encryption-provider-config</code> flag on the <code>kube-apiserver</code> to point to the location of the config file.</em></p>

<p>I have discovered the option <code>--extra-config</code> on <code>minikube start</code> and have tried starting my setup using </p>

<p><code>minikube start --extra-config=apiserver.encryption-provider-config=encryptionConf.yaml</code> </p>

<p>but naturally it doesn't work as <code>encryptionConf.yaml</code> is located in my local file system and not in the pod that's spun up by minikube. The error <code>minikube log</code> gives me is</p>

<p><code>error: error opening encryption provider configuration file "encryptionConf.yaml": open encryptionConf.yaml: no such file or directory</code></p>

<p>What is the best practice to get the encryption configuration file onto the <code>kube-apiserver</code>? Or is <code>minikube</code> perhaps the wrong tool to try out these kinds of things?</p>

<p>I found the solution myself in <a href="https://github.com/kubernetes/minikube/issues/2741#issuecomment-398683171" rel="nofollow noreferrer">this GitHub issue</a> where they have a similar issue for passing a configuration file. The comment that helped me was the slightly hacky solution that made use of the fact that the directory <code>/var/lib/localkube/certs/</code> from the minikube VM is mounted into the apiserver. </p>

<p>So my final solution was to run</p>

<pre><code>minikube mount .:/var/lib/minikube/certs/hack
</code></pre>

<p>where in the current directory I had my <code>encryptionConf.yaml</code> and then start minikube like so</p>

<pre><code>minikube start --extra-config=apiserver.encryption-provider-config=/var/lib/minikube/certs/hack/encryptionConf.yaml
</code></pre>
