kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
resources:
  - resources:
      - secrets
    providers:
      - kms:
          name: kms-provider-1
          cachesize: 1000

	if c.APIVersion != "v1" && c.CacheSize != nil {
		allErrs = append(allErrs, field.Invalid(fieldPath, *c.CacheSize, "cachesize is not supported in v2"))
	}
	if c.APIVersion == "v1" && *c.CacheSize == 0 {
		allErrs = append(allErrs, field.Invalid(fieldPath, *c.CacheSize, fmt.Sprintf(nonZeroErrFmt, "cachesize")))
	}

	return allErrs
}

              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - kms:
          name: testprovider
          endpoint: unix:///tmp/testprovider.sock
          cachesize: 10
          timeout: 10s
      - kms:
          apiVersion: v2
          name: testproviderv2
          endpoint: unix:///tmp/testprovider.sock
      - aescbc:
          keys:
            - name: key1

          name: testproviderv2
          endpoint: unix:///tmp/testprovider.sock
          timeout: 15s
      - kms:
          name: testprovider
          endpoint: unix:///tmp/testprovider.sock
          cachesize: 10
      - secretbox:
          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - aescbc:
          keys:
            - name: key1

              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - kms:
          name: testprovider
          endpoint: unix:///tmp/testprovider.sock
          cachesize: 10
      - kms:
          apiVersion: v2
          name: testproviderv2
          endpoint: unix:///tmp/testprovider.sock
          timeout: 1s
      - identity: {}
      - aesgcm:
          keys:

          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - kms:
          name: testprovider
          endpoint: unix:///tmp/testprovider.sock
          cachesize: 10
      - kms:
          apiVersion: v2
          name: testproviderv2
          endpoint: unix:///tmp/testprovider.sock
          timeout: 10s
          pandas: are the best  # true, but still a typo

func TestEnvelopeCaching(t *testing.T) {
	testCases := []struct {
		desc                     string
		cacheSize                int
		simulateKMSPluginFailure bool
		expectedError            string
	}{
		{
			desc:                     "positive cache size should withstand plugin failure",
			cacheSize:                1000,
			simulateKMSPluginFailure: true,
		},
		{

    private final static Logger LOG = LoggerFactory.getLogger(DefaultInMemoryCacheDecoratorFactory.class);
    private final boolean longLivingProcess;
    private final HeapProportionalCacheSizer cacheSizer = new HeapProportionalCacheSizer();
    private final CrossBuildInMemoryCache<String, CacheDetails> caches;

    public DefaultInMemoryCacheDecoratorFactory(boolean longLivingProcess, CrossBuildInMemoryCacheFactory cacheFactory) {

              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - kms:
          name: testprovider
          endpoint: unix:///tmp/testprovider.sock
          cachesize: 10
      - aescbc:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - secretbox:

	// name is the name of the KMS plugin to be used.
	Name string `json:"name"`
	// cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
	// Set to a negative value to disable caching. This field is only allowed for KMS v1 providers.
	// +optional
	CacheSize *int32 `json:"cachesize,omitempty"`
	// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".