Kubernetes secrets: base64 is not encryption

Kubernetes' Secret type looks protected but its content is base64-encoded, not encrypted. And by default etcd (the cluster datastore) keeps them in cleartext.

The exposures

Whoever gains access to etcd (backups, a control-plane node, API permissions) reads every secret. Whoever has get secrets via RBAC extracts them trivially. And secrets mounted as environment variables leak into logs and process dumps.

kubectl get secret db -o jsonpath='{.data.password}' | base64 -d

Defence

Enable encryption at rest for etcd (a KMS provider). Tight RBAC on secrets. Better still, an external secret manager (Vault, cloud provider) with runtime injection via CSI, so secrets never live in etcd. Prefer mounted volumes to environment variables.