<p>When Kubernetes creates secrets, do they encrypt the given user name and password with certificate?</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
</code></pre>

<p>Secrets are stored in etcd which is highly-available key value store fo cluster information data. Data are encrypted at rest. By default, the <strong>identity</strong> provider is used to protect secrets in etcd, which provides no encryption. </p>

<p>EncryptionConfiguration was introduced to encrypt secrets locally, with a locally managed key. 
Encrypting secrets with a locally managed key protects against an etcd compromise, but it fails to protect against a host compromise. 
Since the encryption keys are stored on the host in the EncryptionConfig YAML file, a skilled attacker can access that file and extract the encryption keys. This was a stepping stone in development to the kms provider, introduced in 1.10, and beta since 1.12. Envelope encryption creates dependence on a separate key, not stored in Kubernetes. 
In this case, an attacker would need to compromise etcd, the kubeapi-server, and the third-party KMS provider to retrieve the plaintext values, providing a higher level of security than locally-stored encryption keys.</p>

<p>More information you can find here:
<a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer"><code>secrets</code></a>, <a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/" rel="nofollow noreferrer"><code>encryption</code></a>.</p>

<p>I hope it helps.</p>
