<p>I am working with Kubernetes on Azure.  I created and configured the <a href="https://azure.microsoft.com/en-gb/services/kubernetes-service/" rel="nofollow noreferrer">Azure Kubernetes Service</a> and <a href="https://azure.microsoft.com/en-gb/services/container-registry/" rel="nofollow noreferrer">Azure Container Registry</a> with the <a href="https://github.com/Azure/azure-cli" rel="nofollow noreferrer">Azure command line interface (CLI)</a> - I have a repository full of Azure CLI bash scripts that create/destroy my cloud infrastructure.</p>

<p>I plan to deploy to Kubernetes using <a href="https://helm.sh/" rel="nofollow noreferrer">Helm</a>.  I plan to use <a href="https://github.com/futuresimple/helm-secrets" rel="nofollow noreferrer">Helm Secrets</a> to encrypt secrets and I am hoping I can use <a href="https://azure.microsoft.com/en-gb/services/key-vault/" rel="nofollow noreferrer">Azure Key Vault</a> to store the encryption keys that encrypt/decrypt the "secrets".</p>

<p>I am now trying to create and configure the Azure Key Vault to work with Azure Kubernetes Service.  I can see how I could create a Key Vault with the Azure CLI but the documentation for <a href="https://github.com/Azure/kubernetes-kms#-acs-engine" rel="nofollow noreferrer">kubernetes-kms</a> suggests that if you configure Kubernetes a certain way then the Key Vault will be automatically created and this will be configured to communicate with Azure Kubernetes Service.</p>

<blockquote>
  <p>"We have added this feature to aks-engine so that you do not have to
  worry about any of the manual steps to set this up."</p>
</blockquote>

<p><a href="https://github.com/Azure/aks-engine/blob/master/docs/topics/features.md#azure-key-vault-data-encryption" rel="nofollow noreferrer">The documentation talks about editing a "kubernetesConfig"</a>, I've not seen a <em>"kubernetesConfig"</em> anywhere yet - I guess that is what you would have if you created your components using Azure Resource Manager (ARM) Templates.</p>

<p><strong>How do I get Azure Key Vault working with <a href="https://github.com/Azure/kubernetes-kms#-acs-engine" rel="nofollow noreferrer">kubernetes-kms</a> using Azure CLI?</strong></p>

<p>e.g. adding <em>enableEncryptionWithExternalKms</em> to the Kubernetes configuration and adding an <em>objectId</em> attribute to the service principal.</p>

Mark McLaren
<p>you cannot do that with AKS. You dont have access to masters to configure them.</p>

<p><a href="https://i.stack.imgur.com/QRjBS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QRjBS.png" alt="enter image description here"></a></p>
