---
schema: deckhand/Passphrase/v1
metadata:
  schema: metadata/Document/v1
  name: apiserver-encryption-key-key1
  layeringDefinition:
    abstract: false
    layer: site
  storagePolicy: cleartext
# head -c 32 /dev/urandom | base64
data: /Y8HgBo/rZywuyF3yE3c1mi4bOWanR6FeC+7f6fS8IE=
...