Kubernetes secret encryption - and two mistakes to avoid

Liz has previously shown how Kubernetes stores secrets in plain text in the etcd database by default. In this video, she walks through how to get your secrets encrypted - and two traps that you can fall into when you try it!

[dratir]

The initial key indeed included a newline ("\n"), which "echo" adds by default. Use "-n" with echo to skip the trailing newline.

[nopsled]

If an attacker gains access to the host; instead of searching for the etcd database, he/she can look for the EncryptionConfiguration yaml available on the disk, which contains base64 encoded secret. How do we deal with this situation? Can we remove this file from the disk after creating the secret?