# Kubernetes secret is stored in plaintext in etcd

- **ID:** `security/kubernetes-secret-etcd-plaintext`
- **Domain:** security
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Kubernetes secrets are base64-encoded but not encrypted at rest in etcd unless encryption at rest is configured, exposing sensitive data to anyone with etcd access.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Kubernetes 1.24 | active | — | — |
| Kubernetes 1.28 | active | — | — |
| etcd 3.5 | active | — | — |

## Workarounds

1. **Enable encryption at rest for Kubernetes secrets. Edit the kube-apiserver configuration to add an EncryptionConfiguration file with a provider like `aescbc`. Example: `--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`.** (85% success)
   ```
   Enable encryption at rest for Kubernetes secrets. Edit the kube-apiserver configuration to add an EncryptionConfiguration file with a provider like `aescbc`. Example: `--encryption-provider-config=/etc/kubernetes/enc/enc.yaml`.
   ```
2. **Use external secret management systems like HashiCorp Vault or AWS Secrets Manager and reference them in your application instead of storing secrets in etcd.** (90% success)
   ```
   Use external secret management systems like HashiCorp Vault or AWS Secrets Manager and reference them in your application instead of storing secrets in etcd.
   ```
3. **Restrict etcd access to only the control plane nodes and use TLS client authentication for all etcd connections.** (60% success)
   ```
   Restrict etcd access to only the control plane nodes and use TLS client authentication for all etcd connections.
   ```

## Dead Ends

- **** — Setting base64 encoding as encryption is a common misconception; base64 is not encryption and can be trivially decoded. (90% fail)
- **** — Using network policies to restrict etcd access doesn't protect against attackers who compromise a pod with etcd access. (50% fail)
- **** — Deleting the secret from etcd without cleaning up backups leaves the plaintext data in backup snapshots. (70% fail)