A teammate claims Secret objects are encrypted because data values…

Question

A teammate claims Secret objects are encrypted because data values appear as base64 in YAML. What correction is accurate?

Accepted Answer

Any Secret stored in etcd is automatically encrypted with a per-namespace passphrase derived from base64. — Base64 is bubble wrap, not a vault—anyone can unwrap it. Secret YAML shows encoded bytes, not ciphertext from encryption-at-rest. Real etcd encryption is a separate cluster setting, not the encoding itself.

Answer

Base64 in Secret data is encoding for transport in manifests; it is not encryption at rest by itself.

Answer

Base64 is AES-256 encryption unique to Kubernetes and needs no encryption-provider configuration.

Answer

Base64 encoding means the Secret cannot be read by anyone with get permission on that object.

A teammate claims Secret objects are encrypted because `data` values appear as base64 in YAML. What correction is accurate?

Short Explanation

Full Explanation