diff --git a/pkg/apis/manager/v2/manager.pb.go b/pkg/apis/manager/v2/manager.pb.go
index aa264212..2960e052 100644
--- a/pkg/apis/manager/v2/manager.pb.go
+++ b/pkg/apis/manager/v2/manager.pb.go
@@ -91,6 +91,55 @@ func (SourceType) EnumDescriptor() ([]byte, []int) {
 	return file_pkg_apis_manager_v2_manager_proto_rawDescGZIP(), []int{0}
 }
 
+// Encryption status enumeration.
+type EncryptionStatus int32
+
+const (
+	// Encryption is not enabled.
+	EncryptionStatus_ENCRYPTION_DISABLED EncryptionStatus = 0
+	// Encryption is enabled and key is provided.
+	EncryptionStatus_ENCRYPTION_ENABLED EncryptionStatus = 1
+)
+
+// Enum value maps for EncryptionStatus.
+var (
+	EncryptionStatus_name = map[int32]string{
+		0: "ENCRYPTION_DISABLED",
+		1: "ENCRYPTION_ENABLED",
+	}
+	EncryptionStatus_value = map[string]int32{
+		"ENCRYPTION_DISABLED": 0,
+		"ENCRYPTION_ENABLED":  1,
+	}
+)
+
+func (x EncryptionStatus) Enum() *EncryptionStatus {
+	p := new(EncryptionStatus)
+	*p = x
+	return p
+}
+
+func (x EncryptionStatus) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EncryptionStatus) Descriptor() protoreflect.EnumDescriptor {
+	return file_pkg_apis_manager_v2_manager_proto_enumTypes[1].Descriptor()
+}
+
+func (EncryptionStatus) Type() protoreflect.EnumType {
+	return &file_pkg_apis_manager_v2_manager_proto_enumTypes[1]
+}
+
+func (x EncryptionStatus) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EncryptionStatus.Descriptor instead.
+func (EncryptionStatus) EnumDescriptor() ([]byte, []int) {
+	return file_pkg_apis_manager_v2_manager_proto_rawDescGZIP(), []int{1}
+}
+
 // SeedPeerCluster represents cluster of seed peer.
 type SeedPeerCluster struct {
 	state         protoimpl.MessageState
@@ -1706,6 +1755,131 @@ func (x *KeepAliveRequest) GetIp() string {
 	return ""
 }
 
+// RequestEncryptionKeyRequest represents request of RequestEncryptionKey.
+type RequestEncryptionKeyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Request source type.
+	SourceType SourceType `protobuf:"varint,1,opt,name=source_type,json=sourceType,proto3,enum=manager.v2.SourceType" json:"source_type,omitempty"`
+	// Source service hostname.
+	Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	// Source service ip.
+	Ip string `protobuf:"bytes,3,opt,name=ip,proto3" json:"ip,omitempty"`
+}
+
+func (x *RequestEncryptionKeyRequest) Reset() {
+	*x = RequestEncryptionKeyRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pkg_apis_manager_v2_manager_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestEncryptionKeyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestEncryptionKeyRequest) ProtoMessage() {}
+
+func (x *RequestEncryptionKeyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_pkg_apis_manager_v2_manager_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestEncryptionKeyRequest.ProtoReflect.Descriptor instead.
+func (*RequestEncryptionKeyRequest) Descriptor() ([]byte, []int) {
+	return file_pkg_apis_manager_v2_manager_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *RequestEncryptionKeyRequest) GetSourceType() SourceType {
+	if x != nil {
+		return x.SourceType
+	}
+	return SourceType_SCHEDULER_SOURCE
+}
+
+func (x *RequestEncryptionKeyRequest) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *RequestEncryptionKeyRequest) GetIp() string {
+	if x != nil {
+		return x.Ip
+	}
+	return ""
+}
+
+// RequestEncryptionKeyResponse represents response of RequestEncryptionKey.
+type RequestEncryptionKeyResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Encryption status.
+	Status EncryptionStatus `protobuf:"varint,1,opt,name=status,proto3,enum=manager.v2.EncryptionStatus" json:"status,omitempty"`
+	// Encryption key provided by manager (only present when status is ENCRYPTION_ENABLED).
+	EncryptionKey []byte `protobuf:"bytes,2,opt,name=encryption_key,json=encryptionKey,proto3,oneof" json:"encryption_key,omitempty"`
+}
+
+func (x *RequestEncryptionKeyResponse) Reset() {
+	*x = RequestEncryptionKeyResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pkg_apis_manager_v2_manager_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestEncryptionKeyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestEncryptionKeyResponse) ProtoMessage() {}
+
+func (x *RequestEncryptionKeyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_pkg_apis_manager_v2_manager_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestEncryptionKeyResponse.ProtoReflect.Descriptor instead.
+func (*RequestEncryptionKeyResponse) Descriptor() ([]byte, []int) {
+	return file_pkg_apis_manager_v2_manager_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *RequestEncryptionKeyResponse) GetStatus() EncryptionStatus {
+	if x != nil {
+		return x.Status
+	}
+	return EncryptionStatus_ENCRYPTION_DISABLED
+}
+
+func (x *RequestEncryptionKeyResponse) GetEncryptionKey() []byte {
+	if x != nil {
+		return x.EncryptionKey
+	}
+	return nil
+}
+
 var File_pkg_apis_manager_v2_manager_proto protoreflect.FileDescriptor
 
 var file_pkg_apis_manager_v2_manager_proto_rawDesc = []byte{
@@ -1979,60 +2153,92 @@ var file_pkg_apis_manager_v2_manager_proto_rawDesc = []byte{
 	0x73, 0x74, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x42, 0x07, 0xfa,
 	0x42, 0x04, 0x32, 0x02, 0x28, 0x01, 0x52, 0x09, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49,
 	0x64, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xfa,
-	0x42, 0x07, 0x72, 0x05, 0x70, 0x01, 0xd0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x70, 0x2a, 0x49, 0x0a,
-	0x0a, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x53,
-	0x43, 0x48, 0x45, 0x44, 0x55, 0x4c, 0x45, 0x52, 0x5f, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x10,
-	0x00, 0x12, 0x0f, 0x0a, 0x0b, 0x50, 0x45, 0x45, 0x52, 0x5f, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45,
-	0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x45, 0x45, 0x44, 0x5f, 0x50, 0x45, 0x45, 0x52, 0x5f,
-	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x10, 0x02, 0x32, 0xcf, 0x05, 0x0a, 0x07, 0x4d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x12, 0x43, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x53, 0x65, 0x65, 0x64, 0x50,
-	0x65, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32,
-	0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32,
-	0x2e, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x54, 0x0a, 0x0d, 0x4c, 0x69, 0x73,
-	0x74, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x20, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x65, 0x64,
-	0x50, 0x65, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6d,
+	0x42, 0x07, 0x72, 0x05, 0x70, 0x01, 0xd0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x70, 0x22, 0x9e, 0x01,
+	0x0a, 0x1b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x41, 0x0a,
+	0x0b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
+	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x42, 0x08, 0xfa, 0x42, 0x05, 0x82,
+	0x01, 0x02, 0x10, 0x01, 0x52, 0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x23, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x68, 0x01, 0x52, 0x08, 0x68, 0x6f, 0x73,
+	0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x17, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x70, 0x01, 0x52, 0x02, 0x69, 0x70, 0x22, 0xa9,
+	0x01, 0x0a, 0x1c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x3e, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x42, 0x08, 0xfa,
+	0x42, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x36, 0x0a, 0x0e, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x0a, 0xfa, 0x42, 0x07, 0x7a, 0x05, 0x10, 0x20,
+	0x18, 0x80, 0x08, 0x48, 0x00, 0x52, 0x0d, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x4b, 0x65, 0x79, 0x88, 0x01, 0x01, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x65, 0x6e, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x2a, 0x49, 0x0a, 0x0a, 0x53, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x43, 0x48, 0x45,
+	0x44, 0x55, 0x4c, 0x45, 0x52, 0x5f, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x10, 0x00, 0x12, 0x0f,
+	0x0a, 0x0b, 0x50, 0x45, 0x45, 0x52, 0x5f, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x10, 0x01, 0x12,
+	0x14, 0x0a, 0x10, 0x53, 0x45, 0x45, 0x44, 0x5f, 0x50, 0x45, 0x45, 0x52, 0x5f, 0x53, 0x4f, 0x55,
+	0x52, 0x43, 0x45, 0x10, 0x02, 0x2a, 0x43, 0x0a, 0x10, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x17, 0x0a, 0x13, 0x45, 0x4e, 0x43,
+	0x52, 0x59, 0x50, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x49, 0x53, 0x41, 0x42, 0x4c, 0x45, 0x44,
+	0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x45, 0x4e, 0x43, 0x52, 0x59, 0x50, 0x54, 0x49, 0x4f, 0x4e,
+	0x5f, 0x45, 0x4e, 0x41, 0x42, 0x4c, 0x45, 0x44, 0x10, 0x01, 0x32, 0xba, 0x06, 0x0a, 0x07, 0x4d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x12, 0x43, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x53, 0x65, 0x65,
+	0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
+	0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
+	0x76, 0x32, 0x2e, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x54, 0x0a, 0x0d, 0x4c,
+	0x69, 0x73, 0x74, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x20, 0x2e, 0x6d,
 	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65,
-	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x49, 0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65,
-	0x72, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76,
-	0x32, 0x2e, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x4b, 0x0a, 0x0e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x21, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x46, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x63,
-	0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65,
+	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x49, 0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50,
+	0x65, 0x65, 0x72, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
+	0x2e, 0x76, 0x32, 0x2e, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x4b, 0x0a, 0x0e,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x12, 0x21,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x53, 0x65, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x46, 0x0a, 0x0c, 0x47, 0x65, 0x74,
+	0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75,
+	0x6c, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65,
+	0x72, 0x12, 0x4c, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x64,
+	0x75, 0x6c, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76,
+	0x32, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65,
 	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
 	0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x12,
-	0x4c, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c,
-	0x65, 0x72, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-	0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x12, 0x57, 0x0a,
-	0x0e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x73, 0x12,
-	0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70,
-	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x41, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x09, 0x4b, 0x65, 0x65, 0x70, 0x41, 0x6c, 0x69,
-	0x76, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-	0x4b, 0x65, 0x65, 0x70, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x28, 0x01, 0x42, 0x2b, 0x5a, 0x29, 0x64, 0x37,
-	0x79, 0x2e, 0x69, 0x6f, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f, 0x70, 0x6b, 0x67, 0x2f,
-	0x61, 0x70, 0x69, 0x73, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x3b,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x57, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72,
+	0x73, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c,
+	0x69, 0x73, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76,
+	0x32, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x72, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x70,
+	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x4c,
+	0x69, 0x73, 0x74, 0x41, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x09, 0x4b, 0x65, 0x65, 0x70, 0x41,
+	0x6c, 0x69, 0x76, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76,
+	0x32, 0x2e, 0x4b, 0x65, 0x65, 0x70, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x28, 0x01, 0x12, 0x69, 0x0a, 0x14,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x4b, 0x65, 0x79, 0x12, 0x27, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76,
+	0x32, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x2b, 0x5a, 0x29, 0x64, 0x37, 0x79, 0x2e, 0x69,
+	0x6f, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x61, 0x70, 0x69,
+	0x73, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x3b, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2047,76 +2253,83 @@ func file_pkg_apis_manager_v2_manager_proto_rawDescGZIP() []byte {
 	return file_pkg_apis_manager_v2_manager_proto_rawDescData
 }
 
-var file_pkg_apis_manager_v2_manager_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_pkg_apis_manager_v2_manager_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_pkg_apis_manager_v2_manager_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_pkg_apis_manager_v2_manager_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
 var file_pkg_apis_manager_v2_manager_proto_goTypes = []interface{}{
-	(SourceType)(0),                  // 0: manager.v2.SourceType
-	(*SeedPeerCluster)(nil),          // 1: manager.v2.SeedPeerCluster
-	(*SeedPeer)(nil),                 // 2: manager.v2.SeedPeer
-	(*GetSeedPeerRequest)(nil),       // 3: manager.v2.GetSeedPeerRequest
-	(*ListSeedPeersRequest)(nil),     // 4: manager.v2.ListSeedPeersRequest
-	(*ListSeedPeersResponse)(nil),    // 5: manager.v2.ListSeedPeersResponse
-	(*UpdateSeedPeerRequest)(nil),    // 6: manager.v2.UpdateSeedPeerRequest
-	(*DeleteSeedPeerRequest)(nil),    // 7: manager.v2.DeleteSeedPeerRequest
-	(*SchedulerCluster)(nil),         // 8: manager.v2.SchedulerCluster
-	(*Scheduler)(nil),                // 9: manager.v2.Scheduler
-	(*GetSchedulerRequest)(nil),      // 10: manager.v2.GetSchedulerRequest
-	(*UpdateSchedulerRequest)(nil),   // 11: manager.v2.UpdateSchedulerRequest
-	(*ListSchedulersRequest)(nil),    // 12: manager.v2.ListSchedulersRequest
-	(*ListSchedulersResponse)(nil),   // 13: manager.v2.ListSchedulersResponse
-	(*URLPriority)(nil),              // 14: manager.v2.URLPriority
-	(*ApplicationPriority)(nil),      // 15: manager.v2.ApplicationPriority
-	(*Application)(nil),              // 16: manager.v2.Application
-	(*ListApplicationsRequest)(nil),  // 17: manager.v2.ListApplicationsRequest
-	(*ListApplicationsResponse)(nil), // 18: manager.v2.ListApplicationsResponse
-	(*KeepAliveRequest)(nil),         // 19: manager.v2.KeepAliveRequest
-	(v2.Priority)(0),                 // 20: common.v2.Priority
-	(*emptypb.Empty)(nil),            // 21: google.protobuf.Empty
+	(SourceType)(0),                      // 0: manager.v2.SourceType
+	(EncryptionStatus)(0),                // 1: manager.v2.EncryptionStatus
+	(*SeedPeerCluster)(nil),              // 2: manager.v2.SeedPeerCluster
+	(*SeedPeer)(nil),                     // 3: manager.v2.SeedPeer
+	(*GetSeedPeerRequest)(nil),           // 4: manager.v2.GetSeedPeerRequest
+	(*ListSeedPeersRequest)(nil),         // 5: manager.v2.ListSeedPeersRequest
+	(*ListSeedPeersResponse)(nil),        // 6: manager.v2.ListSeedPeersResponse
+	(*UpdateSeedPeerRequest)(nil),        // 7: manager.v2.UpdateSeedPeerRequest
+	(*DeleteSeedPeerRequest)(nil),        // 8: manager.v2.DeleteSeedPeerRequest
+	(*SchedulerCluster)(nil),             // 9: manager.v2.SchedulerCluster
+	(*Scheduler)(nil),                    // 10: manager.v2.Scheduler
+	(*GetSchedulerRequest)(nil),          // 11: manager.v2.GetSchedulerRequest
+	(*UpdateSchedulerRequest)(nil),       // 12: manager.v2.UpdateSchedulerRequest
+	(*ListSchedulersRequest)(nil),        // 13: manager.v2.ListSchedulersRequest
+	(*ListSchedulersResponse)(nil),       // 14: manager.v2.ListSchedulersResponse
+	(*URLPriority)(nil),                  // 15: manager.v2.URLPriority
+	(*ApplicationPriority)(nil),          // 16: manager.v2.ApplicationPriority
+	(*Application)(nil),                  // 17: manager.v2.Application
+	(*ListApplicationsRequest)(nil),      // 18: manager.v2.ListApplicationsRequest
+	(*ListApplicationsResponse)(nil),     // 19: manager.v2.ListApplicationsResponse
+	(*KeepAliveRequest)(nil),             // 20: manager.v2.KeepAliveRequest
+	(*RequestEncryptionKeyRequest)(nil),  // 21: manager.v2.RequestEncryptionKeyRequest
+	(*RequestEncryptionKeyResponse)(nil), // 22: manager.v2.RequestEncryptionKeyResponse
+	(v2.Priority)(0),                     // 23: common.v2.Priority
+	(*emptypb.Empty)(nil),                // 24: google.protobuf.Empty
 }
 var file_pkg_apis_manager_v2_manager_proto_depIdxs = []int32{
-	1,  // 0: manager.v2.SeedPeer.seed_peer_cluster:type_name -> manager.v2.SeedPeerCluster
-	9,  // 1: manager.v2.SeedPeer.schedulers:type_name -> manager.v2.Scheduler
+	2,  // 0: manager.v2.SeedPeer.seed_peer_cluster:type_name -> manager.v2.SeedPeerCluster
+	10, // 1: manager.v2.SeedPeer.schedulers:type_name -> manager.v2.Scheduler
 	0,  // 2: manager.v2.GetSeedPeerRequest.source_type:type_name -> manager.v2.SourceType
 	0,  // 3: manager.v2.ListSeedPeersRequest.source_type:type_name -> manager.v2.SourceType
-	2,  // 4: manager.v2.ListSeedPeersResponse.seed_peers:type_name -> manager.v2.SeedPeer
+	3,  // 4: manager.v2.ListSeedPeersResponse.seed_peers:type_name -> manager.v2.SeedPeer
 	0,  // 5: manager.v2.UpdateSeedPeerRequest.source_type:type_name -> manager.v2.SourceType
 	0,  // 6: manager.v2.DeleteSeedPeerRequest.source_type:type_name -> manager.v2.SourceType
-	8,  // 7: manager.v2.Scheduler.scheduler_cluster:type_name -> manager.v2.SchedulerCluster
-	2,  // 8: manager.v2.Scheduler.seed_peers:type_name -> manager.v2.SeedPeer
+	9,  // 7: manager.v2.Scheduler.scheduler_cluster:type_name -> manager.v2.SchedulerCluster
+	3,  // 8: manager.v2.Scheduler.seed_peers:type_name -> manager.v2.SeedPeer
 	0,  // 9: manager.v2.GetSchedulerRequest.source_type:type_name -> manager.v2.SourceType
 	0,  // 10: manager.v2.UpdateSchedulerRequest.source_type:type_name -> manager.v2.SourceType
 	0,  // 11: manager.v2.ListSchedulersRequest.source_type:type_name -> manager.v2.SourceType
-	9,  // 12: manager.v2.ListSchedulersResponse.schedulers:type_name -> manager.v2.Scheduler
-	20, // 13: manager.v2.URLPriority.value:type_name -> common.v2.Priority
-	20, // 14: manager.v2.ApplicationPriority.value:type_name -> common.v2.Priority
-	14, // 15: manager.v2.ApplicationPriority.urls:type_name -> manager.v2.URLPriority
-	15, // 16: manager.v2.Application.priority:type_name -> manager.v2.ApplicationPriority
+	10, // 12: manager.v2.ListSchedulersResponse.schedulers:type_name -> manager.v2.Scheduler
+	23, // 13: manager.v2.URLPriority.value:type_name -> common.v2.Priority
+	23, // 14: manager.v2.ApplicationPriority.value:type_name -> common.v2.Priority
+	15, // 15: manager.v2.ApplicationPriority.urls:type_name -> manager.v2.URLPriority
+	16, // 16: manager.v2.Application.priority:type_name -> manager.v2.ApplicationPriority
 	0,  // 17: manager.v2.ListApplicationsRequest.source_type:type_name -> manager.v2.SourceType
-	16, // 18: manager.v2.ListApplicationsResponse.applications:type_name -> manager.v2.Application
+	17, // 18: manager.v2.ListApplicationsResponse.applications:type_name -> manager.v2.Application
 	0,  // 19: manager.v2.KeepAliveRequest.source_type:type_name -> manager.v2.SourceType
-	3,  // 20: manager.v2.Manager.GetSeedPeer:input_type -> manager.v2.GetSeedPeerRequest
-	4,  // 21: manager.v2.Manager.ListSeedPeers:input_type -> manager.v2.ListSeedPeersRequest
-	6,  // 22: manager.v2.Manager.UpdateSeedPeer:input_type -> manager.v2.UpdateSeedPeerRequest
-	7,  // 23: manager.v2.Manager.DeleteSeedPeer:input_type -> manager.v2.DeleteSeedPeerRequest
-	10, // 24: manager.v2.Manager.GetScheduler:input_type -> manager.v2.GetSchedulerRequest
-	11, // 25: manager.v2.Manager.UpdateScheduler:input_type -> manager.v2.UpdateSchedulerRequest
-	12, // 26: manager.v2.Manager.ListSchedulers:input_type -> manager.v2.ListSchedulersRequest
-	17, // 27: manager.v2.Manager.ListApplications:input_type -> manager.v2.ListApplicationsRequest
-	19, // 28: manager.v2.Manager.KeepAlive:input_type -> manager.v2.KeepAliveRequest
-	2,  // 29: manager.v2.Manager.GetSeedPeer:output_type -> manager.v2.SeedPeer
-	5,  // 30: manager.v2.Manager.ListSeedPeers:output_type -> manager.v2.ListSeedPeersResponse
-	2,  // 31: manager.v2.Manager.UpdateSeedPeer:output_type -> manager.v2.SeedPeer
-	21, // 32: manager.v2.Manager.DeleteSeedPeer:output_type -> google.protobuf.Empty
-	9,  // 33: manager.v2.Manager.GetScheduler:output_type -> manager.v2.Scheduler
-	9,  // 34: manager.v2.Manager.UpdateScheduler:output_type -> manager.v2.Scheduler
-	13, // 35: manager.v2.Manager.ListSchedulers:output_type -> manager.v2.ListSchedulersResponse
-	18, // 36: manager.v2.Manager.ListApplications:output_type -> manager.v2.ListApplicationsResponse
-	21, // 37: manager.v2.Manager.KeepAlive:output_type -> google.protobuf.Empty
-	29, // [29:38] is the sub-list for method output_type
-	20, // [20:29] is the sub-list for method input_type
-	20, // [20:20] is the sub-list for extension type_name
-	20, // [20:20] is the sub-list for extension extendee
-	0,  // [0:20] is the sub-list for field type_name
+	0,  // 20: manager.v2.RequestEncryptionKeyRequest.source_type:type_name -> manager.v2.SourceType
+	1,  // 21: manager.v2.RequestEncryptionKeyResponse.status:type_name -> manager.v2.EncryptionStatus
+	4,  // 22: manager.v2.Manager.GetSeedPeer:input_type -> manager.v2.GetSeedPeerRequest
+	5,  // 23: manager.v2.Manager.ListSeedPeers:input_type -> manager.v2.ListSeedPeersRequest
+	7,  // 24: manager.v2.Manager.UpdateSeedPeer:input_type -> manager.v2.UpdateSeedPeerRequest
+	8,  // 25: manager.v2.Manager.DeleteSeedPeer:input_type -> manager.v2.DeleteSeedPeerRequest
+	11, // 26: manager.v2.Manager.GetScheduler:input_type -> manager.v2.GetSchedulerRequest
+	12, // 27: manager.v2.Manager.UpdateScheduler:input_type -> manager.v2.UpdateSchedulerRequest
+	13, // 28: manager.v2.Manager.ListSchedulers:input_type -> manager.v2.ListSchedulersRequest
+	18, // 29: manager.v2.Manager.ListApplications:input_type -> manager.v2.ListApplicationsRequest
+	20, // 30: manager.v2.Manager.KeepAlive:input_type -> manager.v2.KeepAliveRequest
+	21, // 31: manager.v2.Manager.RequestEncryptionKey:input_type -> manager.v2.RequestEncryptionKeyRequest
+	3,  // 32: manager.v2.Manager.GetSeedPeer:output_type -> manager.v2.SeedPeer
+	6,  // 33: manager.v2.Manager.ListSeedPeers:output_type -> manager.v2.ListSeedPeersResponse
+	3,  // 34: manager.v2.Manager.UpdateSeedPeer:output_type -> manager.v2.SeedPeer
+	24, // 35: manager.v2.Manager.DeleteSeedPeer:output_type -> google.protobuf.Empty
+	10, // 36: manager.v2.Manager.GetScheduler:output_type -> manager.v2.Scheduler
+	10, // 37: manager.v2.Manager.UpdateScheduler:output_type -> manager.v2.Scheduler
+	14, // 38: manager.v2.Manager.ListSchedulers:output_type -> manager.v2.ListSchedulersResponse
+	19, // 39: manager.v2.Manager.ListApplications:output_type -> manager.v2.ListApplicationsResponse
+	24, // 40: manager.v2.Manager.KeepAlive:output_type -> google.protobuf.Empty
+	22, // 41: manager.v2.Manager.RequestEncryptionKey:output_type -> manager.v2.RequestEncryptionKeyResponse
+	32, // [32:42] is the sub-list for method output_type
+	22, // [22:32] is the sub-list for method input_type
+	22, // [22:22] is the sub-list for extension type_name
+	22, // [22:22] is the sub-list for extension extendee
+	0,  // [0:22] is the sub-list for field type_name
 }
 
 func init() { file_pkg_apis_manager_v2_manager_proto_init() }
@@ -2353,19 +2566,44 @@ func file_pkg_apis_manager_v2_manager_proto_init() {
 				return nil
 			}
 		}
+		file_pkg_apis_manager_v2_manager_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestEncryptionKeyRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pkg_apis_manager_v2_manager_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestEncryptionKeyResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_pkg_apis_manager_v2_manager_proto_msgTypes[1].OneofWrappers = []interface{}{}
 	file_pkg_apis_manager_v2_manager_proto_msgTypes[5].OneofWrappers = []interface{}{}
 	file_pkg_apis_manager_v2_manager_proto_msgTypes[8].OneofWrappers = []interface{}{}
 	file_pkg_apis_manager_v2_manager_proto_msgTypes[10].OneofWrappers = []interface{}{}
 	file_pkg_apis_manager_v2_manager_proto_msgTypes[11].OneofWrappers = []interface{}{}
+	file_pkg_apis_manager_v2_manager_proto_msgTypes[20].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_pkg_apis_manager_v2_manager_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   19,
+			NumEnums:      2,
+			NumMessages:   21,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/pkg/apis/manager/v2/manager.pb.validate.go b/pkg/apis/manager/v2/manager.pb.validate.go
index 21926194..c6f446e1 100644
--- a/pkg/apis/manager/v2/manager.pb.validate.go
+++ b/pkg/apis/manager/v2/manager.pb.validate.go
@@ -3272,3 +3272,299 @@ var _ interface {
 	Cause() error
 	ErrorName() string
 } = KeepAliveRequestValidationError{}
+
+// Validate checks the field values on RequestEncryptionKeyRequest with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *RequestEncryptionKeyRequest) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on RequestEncryptionKeyRequest with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the result is a list of violation errors wrapped in
+// RequestEncryptionKeyRequestMultiError, or nil if none found.
+func (m *RequestEncryptionKeyRequest) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *RequestEncryptionKeyRequest) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	if _, ok := SourceType_name[int32(m.GetSourceType())]; !ok {
+		err := RequestEncryptionKeyRequestValidationError{
+			field:  "SourceType",
+			reason: "value must be one of the defined enum values",
+		}
+		if !all {
+			return err
+		}
+		errors = append(errors, err)
+	}
+
+	if err := m._validateHostname(m.GetHostname()); err != nil {
+		err = RequestEncryptionKeyRequestValidationError{
+			field:  "Hostname",
+			reason: "value must be a valid hostname",
+			cause:  err,
+		}
+		if !all {
+			return err
+		}
+		errors = append(errors, err)
+	}
+
+	if ip := net.ParseIP(m.GetIp()); ip == nil {
+		err := RequestEncryptionKeyRequestValidationError{
+			field:  "Ip",
+			reason: "value must be a valid IP address",
+		}
+		if !all {
+			return err
+		}
+		errors = append(errors, err)
+	}
+
+	if len(errors) > 0 {
+		return RequestEncryptionKeyRequestMultiError(errors)
+	}
+
+	return nil
+}
+
+func (m *RequestEncryptionKeyRequest) _validateHostname(host string) error {
+	s := strings.ToLower(strings.TrimSuffix(host, "."))
+
+	if len(host) > 253 {
+		return errors.New("hostname cannot exceed 253 characters")
+	}
+
+	for _, part := range strings.Split(s, ".") {
+		if l := len(part); l == 0 || l > 63 {
+			return errors.New("hostname part must be non-empty and cannot exceed 63 characters")
+		}
+
+		if part[0] == '-' {
+			return errors.New("hostname parts cannot begin with hyphens")
+		}
+
+		if part[len(part)-1] == '-' {
+			return errors.New("hostname parts cannot end with hyphens")
+		}
+
+		for _, r := range part {
+			if (r < 'a' || r > 'z') && (r < '0' || r > '9') && r != '-' {
+				return fmt.Errorf("hostname parts can only contain alphanumeric characters or hyphens, got %q", string(r))
+			}
+		}
+	}
+
+	return nil
+}
+
+// RequestEncryptionKeyRequestMultiError is an error wrapping multiple
+// validation errors returned by RequestEncryptionKeyRequest.ValidateAll() if
+// the designated constraints aren't met.
+type RequestEncryptionKeyRequestMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m RequestEncryptionKeyRequestMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m RequestEncryptionKeyRequestMultiError) AllErrors() []error { return m }
+
+// RequestEncryptionKeyRequestValidationError is the validation error returned
+// by RequestEncryptionKeyRequest.Validate if the designated constraints
+// aren't met.
+type RequestEncryptionKeyRequestValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e RequestEncryptionKeyRequestValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e RequestEncryptionKeyRequestValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e RequestEncryptionKeyRequestValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e RequestEncryptionKeyRequestValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e RequestEncryptionKeyRequestValidationError) ErrorName() string {
+	return "RequestEncryptionKeyRequestValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e RequestEncryptionKeyRequestValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sRequestEncryptionKeyRequest.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = RequestEncryptionKeyRequestValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = RequestEncryptionKeyRequestValidationError{}
+
+// Validate checks the field values on RequestEncryptionKeyResponse with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *RequestEncryptionKeyResponse) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on RequestEncryptionKeyResponse with the
+// rules defined in the proto definition for this message. If any rules are
+// violated, the result is a list of violation errors wrapped in
+// RequestEncryptionKeyResponseMultiError, or nil if none found.
+func (m *RequestEncryptionKeyResponse) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *RequestEncryptionKeyResponse) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	if _, ok := EncryptionStatus_name[int32(m.GetStatus())]; !ok {
+		err := RequestEncryptionKeyResponseValidationError{
+			field:  "Status",
+			reason: "value must be one of the defined enum values",
+		}
+		if !all {
+			return err
+		}
+		errors = append(errors, err)
+	}
+
+	if m.EncryptionKey != nil {
+
+		if l := len(m.GetEncryptionKey()); l < 32 || l > 1024 {
+			err := RequestEncryptionKeyResponseValidationError{
+				field:  "EncryptionKey",
+				reason: "value length must be between 32 and 1024 bytes, inclusive",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+
+	}
+
+	if len(errors) > 0 {
+		return RequestEncryptionKeyResponseMultiError(errors)
+	}
+
+	return nil
+}
+
+// RequestEncryptionKeyResponseMultiError is an error wrapping multiple
+// validation errors returned by RequestEncryptionKeyResponse.ValidateAll() if
+// the designated constraints aren't met.
+type RequestEncryptionKeyResponseMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m RequestEncryptionKeyResponseMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m RequestEncryptionKeyResponseMultiError) AllErrors() []error { return m }
+
+// RequestEncryptionKeyResponseValidationError is the validation error returned
+// by RequestEncryptionKeyResponse.Validate if the designated constraints
+// aren't met.
+type RequestEncryptionKeyResponseValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e RequestEncryptionKeyResponseValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e RequestEncryptionKeyResponseValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e RequestEncryptionKeyResponseValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e RequestEncryptionKeyResponseValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e RequestEncryptionKeyResponseValidationError) ErrorName() string {
+	return "RequestEncryptionKeyResponseValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e RequestEncryptionKeyResponseValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sRequestEncryptionKeyResponse.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = RequestEncryptionKeyResponseValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = RequestEncryptionKeyResponseValidationError{}
diff --git a/pkg/apis/manager/v2/manager.proto b/pkg/apis/manager/v2/manager.proto
index 18242f57..e9f06ab8 100644
--- a/pkg/apis/manager/v2/manager.proto
+++ b/pkg/apis/manager/v2/manager.proto
@@ -302,6 +302,32 @@ message KeepAliveRequest {
   string ip = 4 [(validate.rules).string = {ip: true, ignore_empty: true}];
 }
 
+// RequestEncryptionKeyRequest represents request of RequestEncryptionKey.  
+message RequestEncryptionKeyRequest {  
+  // Request source type.  
+  SourceType source_type = 1 [(validate.rules).enum.defined_only = true];  
+  // Source service hostname.  
+  string hostname = 2 [(validate.rules).string.hostname = true];  
+  // Source service ip.  
+  string ip = 3 [(validate.rules).string.ip = true];  
+}  
+
+// Encryption status enumeration.
+enum EncryptionStatus {
+  // Encryption is not enabled.
+  ENCRYPTION_DISABLED = 0;
+  // Encryption is enabled and key is provided.
+  ENCRYPTION_ENABLED = 1;
+}
+
+// RequestEncryptionKeyResponse represents response of RequestEncryptionKey.
+message RequestEncryptionKeyResponse {
+  // Encryption status.
+  EncryptionStatus status = 1 [(validate.rules).enum.defined_only = true];
+  // Encryption key provided by manager (only present when status is ENCRYPTION_ENABLED).
+  optional bytes encryption_key = 2 [(validate.rules).bytes = {min_len: 32, max_len: 1024}];
+}
+
 // Manager RPC Service.
 service Manager {
   // Get SeedPeer and SeedPeer cluster configuration.
@@ -330,4 +356,7 @@ service Manager {
 
   // KeepAlive with manager.
   rpc KeepAlive(stream KeepAliveRequest)returns(google.protobuf.Empty);
+
+  // Request encryption key from manager.
+  rpc RequestEncryptionKey(RequestEncryptionKeyRequest) returns(RequestEncryptionKeyResponse);
 }
diff --git a/pkg/apis/manager/v2/manager_grpc.pb.go b/pkg/apis/manager/v2/manager_grpc.pb.go
index cfd7923e..b0dfef7e 100644
--- a/pkg/apis/manager/v2/manager_grpc.pb.go
+++ b/pkg/apis/manager/v2/manager_grpc.pb.go
@@ -41,6 +41,8 @@ type ManagerClient interface {
 	ListApplications(ctx context.Context, in *ListApplicationsRequest, opts ...grpc.CallOption) (*ListApplicationsResponse, error)
 	// KeepAlive with manager.
 	KeepAlive(ctx context.Context, opts ...grpc.CallOption) (Manager_KeepAliveClient, error)
+	// Request encryption key from manager.
+	RequestEncryptionKey(ctx context.Context, in *RequestEncryptionKeyRequest, opts ...grpc.CallOption) (*RequestEncryptionKeyResponse, error)
 }
 
 type managerClient struct {
@@ -157,6 +159,15 @@ func (x *managerKeepAliveClient) CloseAndRecv() (*emptypb.Empty, error) {
 	return m, nil
 }
 
+func (c *managerClient) RequestEncryptionKey(ctx context.Context, in *RequestEncryptionKeyRequest, opts ...grpc.CallOption) (*RequestEncryptionKeyResponse, error) {
+	out := new(RequestEncryptionKeyResponse)
+	err := c.cc.Invoke(ctx, "/manager.v2.Manager/RequestEncryptionKey", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ManagerServer is the server API for Manager service.
 // All implementations should embed UnimplementedManagerServer
 // for forward compatibility
@@ -179,6 +190,8 @@ type ManagerServer interface {
 	ListApplications(context.Context, *ListApplicationsRequest) (*ListApplicationsResponse, error)
 	// KeepAlive with manager.
 	KeepAlive(Manager_KeepAliveServer) error
+	// Request encryption key from manager.
+	RequestEncryptionKey(context.Context, *RequestEncryptionKeyRequest) (*RequestEncryptionKeyResponse, error)
 }
 
 // UnimplementedManagerServer should be embedded to have forward compatible implementations.
@@ -212,6 +225,9 @@ func (UnimplementedManagerServer) ListApplications(context.Context, *ListApplica
 func (UnimplementedManagerServer) KeepAlive(Manager_KeepAliveServer) error {
 	return status.Errorf(codes.Unimplemented, "method KeepAlive not implemented")
 }
+func (UnimplementedManagerServer) RequestEncryptionKey(context.Context, *RequestEncryptionKeyRequest) (*RequestEncryptionKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RequestEncryptionKey not implemented")
+}
 
 // UnsafeManagerServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to ManagerServer will
@@ -394,6 +410,24 @@ func (x *managerKeepAliveServer) Recv() (*KeepAliveRequest, error) {
 	return m, nil
 }
 
+func _Manager_RequestEncryptionKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RequestEncryptionKeyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagerServer).RequestEncryptionKey(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/manager.v2.Manager/RequestEncryptionKey",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagerServer).RequestEncryptionKey(ctx, req.(*RequestEncryptionKeyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Manager_ServiceDesc is the grpc.ServiceDesc for Manager service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -433,6 +467,10 @@ var Manager_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListApplications",
 			Handler:    _Manager_ListApplications_Handler,
 		},
+		{
+			MethodName: "RequestEncryptionKey",
+			Handler:    _Manager_RequestEncryptionKey_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
diff --git a/proto/manager.proto b/proto/manager.proto
index 9c26b0d0..5230a04e 100644
--- a/proto/manager.proto
+++ b/proto/manager.proto
@@ -299,6 +299,32 @@ message KeepAliveRequest {
   string ip = 4;
 }
 
+// RequestEncryptionKeyRequest represents request of RequestEncryptionKey.
+message RequestEncryptionKeyRequest {
+  // Request source type.  
+  SourceType source_type = 1;
+  // Source service hostname.
+  string hostname = 2;
+  // Source service ip.
+  string ip = 3;
+}
+
+// Encryption status enumeration.
+enum EncryptionStatus {
+  // Encryption is not enabled.
+  ENCRYPTION_DISABLED = 0;
+  // Encryption is enabled and key is provided.
+  ENCRYPTION_ENABLED = 1;
+}
+
+// RequestEncryptionKeyResponse represents response of RequestEncryptionKey.
+message RequestEncryptionKeyResponse {
+  // Encryption status.
+  EncryptionStatus status = 1;
+  // Encryption key provided by manager (only present when status is ENCRYPTION_ENABLED).
+  optional bytes encryption_key = 2;
+}
+
 // Manager RPC Service.
 service Manager {
   // Get SeedPeer and SeedPeer cluster configuration.
@@ -327,4 +353,7 @@ service Manager {
 
   // KeepAlive with manager.
   rpc KeepAlive(stream KeepAliveRequest)returns(google.protobuf.Empty);
+  
+  // Request encryption key from manager.
+  rpc RequestEncryptionKey(RequestEncryptionKeyRequest) returns(RequestEncryptionKeyResponse);
 }
diff --git a/src/descriptor.bin b/src/descriptor.bin
index f14454bb..aee89a0c 100644
Binary files a/src/descriptor.bin and b/src/descriptor.bin differ
diff --git a/src/manager.v2.rs b/src/manager.v2.rs
index d7c828d2..6babf606 100644
--- a/src/manager.v2.rs
+++ b/src/manager.v2.rs
@@ -398,6 +398,33 @@ pub struct KeepAliveRequest {
     #[prost(string, tag = "4")]
     pub ip: ::prost::alloc::string::String,
 }
+/// RequestEncryptionKeyRequest represents request of RequestEncryptionKey.
+#[derive(serde::Serialize, serde::Deserialize)]
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct RequestEncryptionKeyRequest {
+    /// Request source type.
+    #[prost(enumeration = "SourceType", tag = "1")]
+    pub source_type: i32,
+    /// Source service hostname.
+    #[prost(string, tag = "2")]
+    pub hostname: ::prost::alloc::string::String,
+    /// Source service ip.
+    #[prost(string, tag = "3")]
+    pub ip: ::prost::alloc::string::String,
+}
+/// RequestEncryptionKeyResponse represents response of RequestEncryptionKey.
+#[derive(serde::Serialize, serde::Deserialize)]
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct RequestEncryptionKeyResponse {
+    /// Encryption status.
+    #[prost(enumeration = "EncryptionStatus", tag = "1")]
+    pub status: i32,
+    /// Encryption key provided by manager (only present when status is ENCRYPTION_ENABLED).
+    #[prost(bytes = "vec", optional, tag = "2")]
+    pub encryption_key: ::core::option::Option<::prost::alloc::vec::Vec<u8>>,
+}
 /// Request source type.
 #[derive(serde::Serialize, serde::Deserialize)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
@@ -432,6 +459,36 @@ impl SourceType {
         }
     }
 }
+/// Encryption status enumeration.
+#[derive(serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+#[repr(i32)]
+pub enum EncryptionStatus {
+    /// Encryption is not enabled.
+    EncryptionDisabled = 0,
+    /// Encryption is enabled and key is provided.
+    EncryptionEnabled = 1,
+}
+impl EncryptionStatus {
+    /// String value of the enum field names used in the ProtoBuf definition.
+    ///
+    /// The values are not transformed in any way and thus are considered stable
+    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+    pub fn as_str_name(&self) -> &'static str {
+        match self {
+            EncryptionStatus::EncryptionDisabled => "ENCRYPTION_DISABLED",
+            EncryptionStatus::EncryptionEnabled => "ENCRYPTION_ENABLED",
+        }
+    }
+    /// Creates an enum from field names used in the ProtoBuf definition.
+    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+        match value {
+            "ENCRYPTION_DISABLED" => Some(Self::EncryptionDisabled),
+            "ENCRYPTION_ENABLED" => Some(Self::EncryptionEnabled),
+            _ => None,
+        }
+    }
+}
 /// Generated client implementations.
 pub mod manager_client {
     #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
@@ -734,6 +791,32 @@ pub mod manager_client {
                 .insert(GrpcMethod::new("manager.v2.Manager", "KeepAlive"));
             self.inner.client_streaming(req, path, codec).await
         }
+        /// Request encryption key from manager.
+        pub async fn request_encryption_key(
+            &mut self,
+            request: impl tonic::IntoRequest<super::RequestEncryptionKeyRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::RequestEncryptionKeyResponse>,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::new(
+                        tonic::Code::Unknown,
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic::codec::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/manager.v2.Manager/RequestEncryptionKey",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("manager.v2.Manager", "RequestEncryptionKey"));
+            self.inner.unary(req, path, codec).await
+        }
     }
 }
 /// Generated server implementations.
@@ -797,6 +880,14 @@ pub mod manager_server {
             &self,
             request: tonic::Request<tonic::Streaming<super::KeepAliveRequest>>,
         ) -> std::result::Result<tonic::Response<()>, tonic::Status>;
+        /// Request encryption key from manager.
+        async fn request_encryption_key(
+            &self,
+            request: tonic::Request<super::RequestEncryptionKeyRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::RequestEncryptionKeyResponse>,
+            tonic::Status,
+        >;
     }
     /// Manager RPC Service.
     #[derive(Debug)]
@@ -1282,6 +1373,52 @@ pub mod manager_server {
                     };
                     Box::pin(fut)
                 }
+                "/manager.v2.Manager/RequestEncryptionKey" => {
+                    #[allow(non_camel_case_types)]
+                    struct RequestEncryptionKeySvc<T: Manager>(pub Arc<T>);
+                    impl<
+                        T: Manager,
+                    > tonic::server::UnaryService<super::RequestEncryptionKeyRequest>
+                    for RequestEncryptionKeySvc<T> {
+                        type Response = super::RequestEncryptionKeyResponse;
+                        type Future = BoxFuture<
+                            tonic::Response<Self::Response>,
+                            tonic::Status,
+                        >;
+                        fn call(
+                            &mut self,
+                            request: tonic::Request<super::RequestEncryptionKeyRequest>,
+                        ) -> Self::Future {
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Manager>::request_encryption_key(&inner, request)
+                                    .await
+                            };
+                            Box::pin(fut)
+                        }
+                    }
+                    let accept_compression_encodings = self.accept_compression_encodings;
+                    let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
+                    let inner = self.inner.clone();
+                    let fut = async move {
+                        let method = RequestEncryptionKeySvc(inner);
+                        let codec = tonic::codec::ProstCodec::default();
+                        let mut grpc = tonic::server::Grpc::new(codec)
+                            .apply_compression_config(
+                                accept_compression_encodings,
+                                send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
+                            );
+                        let res = grpc.unary(method, req).await;
+                        Ok(res)
+                    };
+                    Box::pin(fut)
+                }
                 _ => {
                     Box::pin(async move {
                         Ok(