// Module included in the following assemblies:
//
// * etcd/KMS_v2/index.adoc

:_mod-docs-content-type: CONCEPT
[id="kms-about_{context}"]
= About {KMS} encryption

[role="_abstract"]
{KMS} uses external Key Management Services to encrypt etcd data and centralize key management.

{KMS} provides:

* Customer-managed encryption keys that never leave the external KMS
* Centralized key management and auditing
* Regulatory compliance support

[id="kms-encrypted-resources_{context}"]
== Encrypted resources

When you enable KMS encryption, {product-title} encrypts the following sensitive resources in etcd:

* Secrets
* ConfigMaps
* Routes
* OAuth access tokens
* OAuth authorize tokens

[NOTE]
====
Resource types, namespaces, and object names are not encrypted.
====

[role="_additional-resources"]
.Additional resources

* link:https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/[Using a KMS provider for data encryption]