[kube-system]

I think that’s more of a technical question. How would that entity be granted the ability to decrypt your data without the OEM being able?