Mastering Kubernetes - Second Edition

Configuring encryption at Rest

You need to pass this argument when you start the API server:

--experimental-encryption-provider-config <encryption config file>   

Here is a sample encryption config:

kind: EncryptionConfigapiVersion: v1resources:  - resources:    - secrets    providers:    - identity: {}    - aesgcm:        keys:        - name: key1          secret: c2VjcmV0IGlzIHNlY3VyZQ==        - name: key2          secret: dGhpcyBpcyBwYXNzd29yZA==    - aescbc:        keys:        - name: key1          secret: c2VjcmV0IGlzIHNlY3VyZQ==        - name: key2          secret: dGhpcyBpcyBwYXNzd29yZA==    - secretbox:        keys:        - name: key1          secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=