I have been trying lately to implement vault configurations on Kubernetes.

I have encountered a few issues and I wanted to ask if maybe there is a solution for that.

my question is where to store the unsealing tokens and the root token?

I saw some solutions where it is being stored in AWS KMS or google cloud.

in my case I need my cluster to be cloud agnostic ( even on premises ) which mean I prefer not to rely on a specific cloud resources.

any idea how I can secure those vault credentials since saving those values in a config-map/secret will make the vault easily accessed.

thanks in advance.