Kubernetes Practical By Samson Tanimawo, PhD Published Nov 10, 2025 4 min read

Secret Encryption at Rest

K8s Secrets can be encrypted at rest. The setup.

Config

EncryptionConfiguration in api-server.

KMS provider for key management.

etcdctl get secrets/foo shows encrypted blob.

Direct verification.

Quarterly key rotation. Re-encrypt existing.

Documented procedure.