Linux_Foundation
CKS · Question #20
Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g.: ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret…
ETCD secret encryption can be verified with the help of etcdctl command line utility. ETCD secrets are stored at the path /registry/secrets/$namespace/$secret on the master node. The below command can be used to verify if the particular ETCD secret is encrypted or not…
Submitted by saadiq_pk· May 5, 2026Cluster Hardening
Question
Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value
for e.g.:
ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" --cert="server.crt" --key="server.key"
Output
[Image shows etcd output with keys like 'cks-secret', 'supersescret', 'tonsecret' and their values]
Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.
Exhibits
Explanation
ETCD secret encryption can be verified with the help of etcdctl command line utility. ETCD secrets are stored at the path /registry/secrets/$namespace/$secret on the master node. The below command can be used to verify if the particular ETCD secret is encrypted or not.
ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C
Topics
#etcd secrets encryption#secrets at rest#Encryption Configuration#AES-CBC
Community Discussion
No community discussion yet for this question.