How to create a static pod for KMS plugin in Rancher?

To enable KMS encryption provider we need to have all plugin info inside a static pod on same api server node.

So pod yaml need to be inside api container ??

Or I can have it as a normal pod with nodeselector to run on control plane node?

What have you tried and what have you observed from that work ?