4. Encrypt Secrets at rest in etcd
Write an EncryptionConfiguration that encrypts Secrets at rest: • apiVersion: apiserver.config.k8s.io/v1 • kind: EncryptionConfiguration • resources: a list of ONE entry with: – resources: [secrets] – providers: a list of two — first an `aescbc` provider (with keys: a list of one {name: key1, secret: c2VjcmV0}), then an `identity: {}` provider last.
By default Secrets are stored as PLAINTEXT in etcd — anyone with an etcd backup reads them. This config (fed to the API server) fixes that. The `providers` list is ORDERED: the first entry encrypts new writes (here `aescbc`), and all entries are tried on read. Putting `identity` (no-op/plaintext) LAST lets the API server still read pre-existing unencrypted data during migration, while all new writes are encrypted. Put identity first and nothing gets encrypted.