<p>I am using GKE(Google Kubernetes Engine) 1.13.6-gke.6 and I need to provide etcd encryption evidence for <a href="https://www.investopedia.com/terms/p/pci-compliance.asp" rel="noreferrer">PCI</a> purposes.<br> I have used <code>--data-encryption-key</code> flag and used a <a href="https://cloud.google.com/kms/docs/quickstart" rel="noreferrer">KMS</a> key to encrypt secrets following <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets" rel="noreferrer">this</a> documentation.</p>

<p>I need to give a set of commands which will prove that the information stored in <a href="https://kubernetes.io/docs/concepts/overview/components/#etcd" rel="noreferrer">etcd</a> of the master node is encrypted.</p>

<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#verifying-that-data-is-encrypted" rel="noreferrer">Here</a> is how we verify that the secrets stored inside a normal Kuebrnetes Cluster (<strong>not GKE</strong>) are encrypted.<br><br>As we know GKE is a managed service and master node is managed by GCP. Is there a way to access GKE "etcd" to see the stored secrets and data at rest ?</p>

<p>Why do you have to prove that the information is encrypted? GKE is covered by <a href="https://cloud.google.com/security/compliance/pci-dss/" rel="noreferrer">Google Cloud's PCI DSS certification</a> and since the master is a part of the "cluster as a service" that should be out of scope for what you need to show since you don't (and can't) control the way in which the storage is implemented. </p>

<p>One thing you can do is use <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets" rel="noreferrer">Application-layer Secrets Encryption</a> to encrypt your secrets with your own key stored in <a href="https://cloud.google.com/kms/docs/" rel="noreferrer">Cloud KMS</a>. For your secrets you would be able to run commands to prove that additional level of encryption. </p>
