KMS plugin support for UCP

Estimated reading time: 1 minute

This topic applies to Docker Enterprise.

The Docker Enterprise platform business, including products, customers, and employees, has been acquired by Mirantis, inc., effective 13-November-2019. For more information on the acquisition and how it may affect you and your business, refer to the Docker Enterprise Customer FAQ.

Docker Universal Control Plane (UCP) 3.2.5 adds support for a Key Management Service (KMS) plugin to allow access to third-party secrets management solutions, such as Vault. This plugin is used by UCP for access from Kubernetes clusters.


KMS must be deployed before a machine becomes a UCP manager or it may be considered unhealthy. UCP will not health check, clean up, or otherwise manage the KMS plugin.


KMS plugin configuration should be done through UCP. UCP will maintain ownership of the Kubernetes EncryptionConfig file, where the KMS plugin is configured for Kubernetes. UCP does not currently check this file’s contents after deployment.

UCP adds new configuration options to the cluster configuration table. These options are not exposed through the web UI, but can be configured via the API.

The following table shows the configuration options for the KMS plugin. These options are not required.

Parameter Type Description
kms_enabled bool Determines if UCP should configure a KMS plugin.
kms_name string Name of the KMS plugin resource (for example, “vault”).
kms_endpoint string Path of the KMS plugin socket. This path must refer to a UNIX socket on the host (for example, “/tmp/socketfile.sock”). UCP will bind mount this file to make it accessible to the API server.
kms_cachesize int Number of data encryption keys (DEKs) to be cached in the clear.

Where to go next

ucp, kms, kubernetes, plugin, configuration