<p>By default all the data stored in etcd is not encrypted, for the production deployments, some of the data stored in etcd need to be encrypted such as secrets, Is there a way to store the secrets, in an encrypted way, in etcd, by default.</p>

<p>To have encryption you need to instruct <code>apiserver</code> service with this parameter:</p>

<p><code>--experimental-encryption-provider-config=/var/lib/kubernetes/encryption-config.yaml</code></p>

<p>where the yaml file contains this:</p>

<pre><code>kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: ${ENCRYPTION_KEY}
      - identity: {}
</code></pre>

<p>here the provider is aescbc (the strongest encryption) and the variable is generated before:</p>

<pre><code>ENCRYPTION_KEY=$(head -c 32 /dev/urandom | base64)
</code></pre>

<p>Take a look to these documents:</p>

<ul>
<li><p><a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/</a></p></li>
<li><p><a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/06-data-encryption-keys.md" rel="nofollow noreferrer">https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/06-data-encryption-keys.md</a> (and the following md files)</p></li>
</ul>
