Question

A security audit of a company's managed Kubernetes cluster reveals that application credentials stored as Kubernetes Secrets are readable in plaintext by anyone with direct access to the underlying etcd datastore backups. The security team must ensure these Secrets are protected at rest without requiring developers to change how they consume Secrets in their pods. Which action BEST addresses this finding?

Accepted Answer

Enable encryption at rest for etcd using an external KMS provider integrated with the cluster's encryption configuration

Answer

Base64-encode all Secret values before storing them in the cluster

Answer

Move the credentials into ConfigMaps and restrict RBAC access to the namespace

Answer

Apply a NetworkPolicy that blocks external traffic to the etcd port