How is the sensitive data stored in Kubernetes Secrets?

How is the sensitive data stored in Kubernetes Secrets?

• A. It is encrypted
• B. It is hashed
• C. It is stored as plain text
• D. It is encoded

Answer: (D)

Sensitive data in Kubernetes Secrets is stored as base64-encoded strings in etcd. This means the values are not stored in plain text, but they are not encrypted by default either—the encoding is reversible. To actually protect secrets at rest, Kubernetes can be configured with encryption at rest (EncryptionConfiguration with a KMS/provider). The other options don’t fit because hashing is irreversible, encryption isn’t the default storage method, and plain text isn’t how Kubernetes stores secret data.

Sensitive data in Kubernetes Secrets is stored as base64-encoded strings in etcd. This means the values are not stored in plain text, but they are not encrypted by default either—the encoding is reversible. To actually protect secrets at rest, Kubernetes can be configured with encryption at rest (EncryptionConfiguration with a KMS/provider). The other options don’t fit because hashing is irreversible, encryption isn’t the default storage method, and plain text isn’t how Kubernetes stores secret data.