Reference

Every bao-kms-provider command, what doctor and verify-key check, the rotation reports, file generation with init, common flags, and exit codes.

Every provider configuration field with its default and meaning, the identity-bearing fields, validation rules, and environment overrides.

Each EncryptionConfiguration field as the provider uses it, how automatic reload behaves, and what widening the resource list costs.

Health endpoints, every Prometheus metric, stable log fields, error classes, recommended alerts, and incident-only debug correlation.

What the API server can rely on from the provider's Status, Encrypt, and Decrypt calls, the protocol and size limits, and the conformance cases that prove it.

The key_id format and derivation, KMS v2 annotations, the AAD envelope, decrypt validation order, and the invariants of local registry state.

The tested Kubernetes, OpenBao, auth, and deployment matrix, the Transit features the provider needs, and the compatibility promises between releases.

Current release maturity, what a preview covers, release channels, versioning, security fixes, the stable release bar, and artifact names.