> This isn't universally true anymore, at least with AWS EKS. The underlying etcd being encrypted at rest doesn't really change the fact that anything with acc

> This isn't universally true anymore, at least with AWS EKS. The underlying etcd being encrypted at rest doesn't really change the fact that anything with access to the running etcd has full access to all secrets (okay, there are ACLs, but they're quite complex).