Etcd Encryption at Rest & Basic Control Plane Hardening
Duration: ~10 minutes
Overview
Enable etcd encryption at rest so Secrets and similar data are not readable as plaintext on disk, and review basic control-plane hardening options.
Why it matters
Etcd holds Secrets, ConfigMaps, and other API objects. If someone gets raw etcd storage without encryption at rest, they can read that data. Turning encryption on closes that path and is often required for compliance.
What does it solve
-
Secrets readable from etcd disk if the store is accessed
-
Gaps against common data-protection audit asks
-
Weak control-plane posture when etcd is treated as "just another volume"
Your Mission
If an attacker (or stolen backup) can read raw etcd disks, unencrypted Secrets become free credentials. Confirm encryption posture and that control-plane components are present and healthy—deny the “steal the volume, read the cluster” path.
Click each step only if you need a hint.
Check whether encryption is already defending Secrets at rest
oc get encryptionconfig cluster -o yamlVerify the API server encryption type
oc get apiserver cluster -o jsonpath='{.spec.encryption.type}'| Enabling etcd encryption requires cluster-admin access and may require a cluster restart. Typically done at install or via cluster config updates. |
Quick control-plane health sweep
oc get nodes -o wide
oc get pods -n openshift-kube-apiserver
oc get pods -n openshift-etcdCleanup
No cleanup needed for this lab.
Debrief
You checked whether etcd encryption at rest is defending Secrets on disk and swept basic control-plane health so plaintext storage is not a silent gap.
What breaks without this:
-
Unencrypted etcd / backups → Secrets readable if storage is stolen
-
Weak control-plane posture → larger blast radius when the API plane is probed
Controls that matter: etcd encryption at rest, key management, node/API hardening, and audit so you can prove the control is on.
Quick facts: enable at install when you can; enabling later needs careful planning. Performance impact is usually minimal versus the data-protection win.
