Protect cluster secrets by enabling KMS v2 for etcd encryption using a Key Vault key secured via Private Link. • KMS profile visible in az aks show • Key Vault restricted to private access only • Verified secrets encryption at rest