kubespray/roles/kubernetes/control-plane/templates/secrets_encryption.yaml.j2

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
{{ kube_encryption_resources | to_nice_yaml | indent(4, True) }}
    providers:
    - {{ kube_encryption_algorithm }}:
        keys:
        - name: key
          secret: {{ kube_encrypt_token | b64encode }}
    - identity: {}