The APIServer Encryption configuration is the single point of entry for configuring KMS encryption.

OpenShift will manage the KMS plugin on behalf of the user on both releases, TP and GA.

At the moment of writing, the KMS plugin will be deployed as a static pod. The various openshift apiservers will either:

1. Each deploy their own kms plugin static pod
2. Share the socket for the one kms plugin static pod (the approach taken in the PRs linked to this ticket)

We'll probably go with 1.