--- title: Medium | daily.dev description: Kubernetes clusters store sensitive data—Secrets, ConfigMaps, service accounts, and custom resources—in etcd, often in plaintext by default. Encryption at rest... canonical: https://daily.dev/posts/medium-kqhena7w8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Medium | daily.dev og:description: Kubernetes clusters store sensitive data—Secrets, ConfigMaps, service accounts, and custom resources—in etcd, often in plaintext by default. Encryption at rest... og:url: https://daily.dev/posts/medium-kqhena7w8 og:image: https://api.daily.dev/og/posts/KQhEnA7w8.png og:image:alt: Medium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Medium **[Medium](https://daily.dev/sources/medium_js)** · 16 min read · 1 upvotes · 0 comments ## Summary Kubernetes clusters store sensitive data—Secrets, ConfigMaps, service accounts, and custom resources—in etcd, often in plaintext by default. Encryption at rest adds a cryptographic layer so that raw etcd data cannot be read without the corresponding key. The post explains what Kubernetes encrypts (API objects in etcd) versus what it does not (Persistent Volumes, container logs, application data), how the EncryptionConfiguration file and kube-apiserver work together, and the available providers: identity (no-op), AES-CBC, AES-GCM, secretbox, and KMS (v2 recommended for production). A step-by-step walkthrough covers generating a 32-byte key, creating the EncryptionConfiguration, mounting it into the static Pod manifest, verifying raw etcd output for the encrypted prefix, rewriting existing objects to migrate them, and rotating keys safely. Production guidance recommends preferring KMS v2 for key isolation, applying least-privilege RBAC, enabling audit logging, protecting the key file separately from etcd backups, and treating encryption as one layer in a ten-layer security model. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable encryption at rest for Kubernetes Secrets stored in etcd? Create an EncryptionConfiguration file specifying an encryption provider such as aescbc with a 32-byte base64-encoded key, listing secrets (and optionally configmaps) as protected resources, then pass the file path via the --encryption-provider-config argument to kube-apiserver and mount it as a volume. Existing objects must be rewritten (kubectl get secrets -o json | kubectl replace -f -) since only newly written or updated objects get encrypted. _daily.dev surfaces hands-on guides like this for engineers hardening etcd and Kubernetes secret storage._ ### Is base64 encoding in a Kubernetes Secret the same as encryption? No, base64 is encoding, not encryption, and anyone with access to the value can decode it with a simple base64 --decode command. Without an encryption provider configured via EncryptionConfiguration, the Kubernetes API server writes plaintext representations of resources to etcd, so base64-encoded Secret data offers no real confidentiality protection against etcd or backup exposure. _developers weighing real security controls versus false assumptions can track Kubernetes secrets guidance on daily.dev._ ### What is the difference between KMS v1 and KMS v2 in Kubernetes, and which should I use? KMS v2 is the recommended choice for Kubernetes encryption providers because it is stable as of Kubernetes 1.29, while KMS v1 is deprecated and disabled by default on modern releases. KMS v2 uses envelope encryption where a Data Encryption Key encrypts the data and a Key Encryption Key managed by an external KMS protects that DEK, improving key isolation over locally stored AES keys. _teams choosing a key-management approach for Kubernetes can follow encryption provider updates on daily.dev._ ## Similar posts on daily.dev - [Kubernetes Secrets and ConfigMaps in 2026: the Secret is the last mile](https://daily.dev/posts/kubernetes-secrets-and-configmaps-in-2026-the-secret-is-the-last-mile-cq5l9gosq) · Giant Swarm · 11 upvotes · 0 comments - [Apache Iceberg Table Encryption with KMS](https://daily.dev/posts/apache-iceberg-table-encryption-with-kms-nu5cd83l2) · Dremio Blog · 0 upvotes · 0 comments - [Azure Key Vault for Credentials](https://daily.dev/posts/azure-key-vault-for-credentials-oiz0l4kto) · Couchbase · 0 upvotes · 0 comments - [How to Encrypt Terraform State Files](https://daily.dev/posts/how-to-encrypt-terraform-state-files-xqueae5zq) · Spacelift · 2 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/medium-kqhena7w8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Medium","url":"https://daily.dev/posts/medium-kqhena7w8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/medium-kqhena7w8"},"datePublished":"2026-07-19T07:32:49.276Z","dateModified":"2026-09-14T09:27:55.593Z","description":"Kubernetes clusters store sensitive data—Secrets, ConfigMaps, service accounts, and custom resources—in etcd, often in plaintext by default. Encryption at rest...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fdcab20dd88de0fc233269034864c70?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fdcab20dd88de0fc233269034864c70?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/medium-kqhena7w8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,kubernetes","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Medium"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/medium-kqhena7w8#faq","mainEntity":[{"@type":"Question","name":"How do I enable encryption at rest for Kubernetes Secrets stored in etcd?","acceptedAnswer":{"@type":"Answer","text":"Create an EncryptionConfiguration file specifying an encryption provider such as aescbc with a 32-byte base64-encoded key, listing secrets (and optionally configmaps) as protected resources, then pass the file path via the --encryption-provider-config argument to kube-apiserver and mount it as a volume. Existing objects must be rewritten (kubectl get secrets -o json | kubectl replace -f -) since only newly written or updated objects get encrypted. daily.dev surfaces hands-on guides like this for engineers hardening etcd and Kubernetes secret storage."}},{"@type":"Question","name":"Is base64 encoding in a Kubernetes Secret the same as encryption?","acceptedAnswer":{"@type":"Answer","text":"No, base64 is encoding, not encryption, and anyone with access to the value can decode it with a simple base64 --decode command. Without an encryption provider configured via EncryptionConfiguration, the Kubernetes API server writes plaintext representations of resources to etcd, so base64-encoded Secret data offers no real confidentiality protection against etcd or backup exposure. developers weighing real security controls versus false assumptions can track Kubernetes secrets guidance on daily.dev."}},{"@type":"Question","name":"What is the difference between KMS v1 and KMS v2 in Kubernetes, and which should I use?","acceptedAnswer":{"@type":"Answer","text":"KMS v2 is the recommended choice for Kubernetes encryption providers because it is stable as of Kubernetes 1.29, while KMS v1 is deprecated and disabled by default on modern releases. KMS v2 uses envelope encryption where a Data Encryption Key encrypts the data and a Key Encryption Key managed by an external KMS protects that DEK, improving key isolation over locally stored AES keys. teams choosing a key-management approach for Kubernetes can follow encryption provider updates on daily.dev."}}]} ```