Creating this umbrella issue to track how we handle storage migration for kms:

• How to interact with kms v2 design of using currentKeyID
• How will it work for v1beta1to enable migration from AES-CBC to AES-GCM
  

  kubernetes/staging/src/k8s.io/apiserver/pkg/server/options/encryptionconfig/config.go

  Lines 490 to 492 in d581cc9

  	// TODO(aramase): Post v1.25: We cannot drop CBC read support until we automate storage migration.
  	// We could have a release note that hard requires users to perform storage migration.
  	return unionTransformers{aestransformer.NewGCMTransformer(block), aestransformer.NewCBCTransformer(block)}

/sig auth
/cc @enj
/triage accepted