Securing etcd: Encryption at Rest, TLS, and Access Control

Calendar February 22, 2026
Security
Intermediate
Etcd-Security-Hardening, Encryption-at-Rest, Certificate-Management, Backup-Security
Etcd, Encryption, Tls, Secrets, Backup-Security
Kubectl, Etcdctl, Kubeadm, Openssl

Securing etcd#

etcd is the single most critical component in a Kubernetes cluster. It stores everything: pod specs, secrets, configmaps, RBAC rules, service account tokens, and all cluster state. By default, Kubernetes secrets are stored in etcd as base64-encoded plaintext. Anyone with read access to etcd has read access to every secret in the cluster. Securing etcd is not optional.

Why etcd Is the Crown Jewel#

Run this against an unencrypted etcd and you will see why: