Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g.: ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca

Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g.: ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" --cert="server.crt" --key="server.key" Output [Image shows etcd output with keys like 'cks-secret', 'supersescret', 'tonsecret' and their values] Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.