kubespray/roles/kubernetes/master/templates/secrets_encryption.yaml.j2

kind: EncryptionConfig
apiVersion: v1
resources:
  - resources: {{ kube_encryption_resources }}
    providers:
    - {{ kube_encryption_algorithm }}:
        keys:
        - name: key
          secret: {{ kube_encrypt_token | b64encode }}
    - identity: {}