---
schema: deckhand/Passphrase/v1
metadata:
  schema: metadata/Document/v1
  name: apiserver-encryption-key-key1
  layeringDefinition:
    abstract: false
    layer: site
  storagePolicy: cleartext
# https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/
# use head -c 32 /dev/urandom | base64
data: n9VBwseT/JjV7r9vbUR/MvCobe01Bdh9XtWgsNF5zLY=
...