The kublet API hardening looks very useful and there seems to a lot of good (security) stuff coming with each release. In many environments, however, other asp

The kublet API hardening looks very useful and there seems to a lot of good (security) stuff coming with each release. In many environments, however, other aspects of Kube's security prove inadequate. For instance, there is currently no way to protect secrets in an environment requiring an HSM for certain keys. In contrast, secrets are stored in an etcd server accessible to the entire cluster (please correct me if this is out of date.) One article discussing this: https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-modern-secret-management-2017-c82ec9136a3d#.od5x387qj https://medium.com/on-docker/secrets-and-lie-abilities-the-s...