Skip to content
Captain's Academy0
← Kubernetes sea chart
Island 4 · App Lifecycle · Port 4.7

Encrypting Secrets at rest

Ask the Captain
Instagram
Anyone who reads etcd reads your Secrets. Let's fix it.
You'll learn to

explain EncryptionConfiguration and prove it in etcd

Recap

  1. 1EncryptionConfiguration: aescbc first, identity last
  2. 2--encryption-provider-config on the API server
  3. 3Rewrite old Secrets: get -A -o json | replace -f -
Check yourself

Your providers list starts with identity, then aescbc. Are new Secrets encrypted?

4.7

Stamp this lesson

Watched it and passed the check? Mark it in your logbook.