NewEncryptionConfigObserver sets encryption-provider-config flag to /etc/kubernetes/static-pod-resources/secrets/encryption-config/encryption-config in the configuration file if encryption-config in the targetNamespace is found note: the flag is not removed when the encryption-config was accidentally removed there is an active reconciliation loop in place that will eventually synchronize the missing resource.