Hands-on Lab·Certified Kubernetes Security Specialist
Encrypting Secrets at Rest in etcd
Secrets are base64 in the API and plaintext in etcd, and turning that off means editing the apiserver. This guide does it on a real control plane, proves it from inside etcd, and then finds the Secrets that encryption did not touch.
Microservice Vulnerabilities Guide 20 of 40 Advanced
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1 - tunnel/VXLAN, with Hubble relay and UI
- Host OSUbuntu 26.04 LTS, kernel 7.0.0-29
- Built withkubeadm v1.36.3 - podSubnet 10.244.0.0/16, serviceSubnet 10.96.0.0/12
- TimeAbout 22 min
- Reviewed25 August 2026
Written against the versions above. Run on cka8001, the single-node cluster this path uses for control-plane changes. The manifest was backed up first and restored at the end, and the test namespace was deleted before the revert.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA8001 | 192.168.0.56 | Ubuntu 26.04 LTS | Single Node (control plane, untainted) | 2 Core | 4 GB | 50 GB |
Before you start
-
What a Secret looks like in etcd
-
The configuration, and the flag that loads it
-
The new Secret, and the old one
-
Rewrite what is already there