kubespray/roles/kubernetes/master/templates/secrets_encryption.yaml.j2

kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
{{ kube_encryption_resources|to_nice_yaml|indent(4, True) }}
    providers:
    - {{ kube_encryption_algorithm }}:
        keys:
        - name: key
          secret: {{ kube_encrypt_token | b64encode }}
    - identity: {}