<p>K8s has this feature to <a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/" rel="nofollow noreferrer">encrypt secret data</a>, which requires modification of kube-apiserver config, how can i do this in GKE?</p>

<p>Short answer is, you can't.</p>

<p>The Kubernetes Engine master is managed by Google, so you can't change its runtime parameters. Nonetheless, while the data may not be encrypted inside the etcd running on the master node, <a href="https://cloud.google.com/security/encryption-at-rest/default-encryption/#encryption_of_data_at_rest" rel="nofollow noreferrer">the contents of the master node itself are encrypted</a> as the link Will pointed to explains.</p>
