API server sets --encryption-provider-config

​

What this check verifies

Kubernetes API server pods include --encryption-provider-config, supplying an EncryptionConfiguration to apply encryption at rest to selected API resources stored in etcd.

​

Risk

Absent an encryption provider, Secrets and credentials are stored in plaintext in etcd and backups. Access to etcd, control plane disks, or snapshots can expose keys and tokens, enabling unauthorized API calls and lateral movement, compromising confidentiality and integrity.

​

Recommendation

Enable encryption at rest with an EncryptionConfiguration and run with --encryption-provider-config using a non-identity provider (prefer kms v2). Apply least privilege to key/KMS access, rotate keys, restrict config file access, keep settings consistent across API servers, and re-encrypt existing objects.

​

Remediation

Dashboard steps

1. SSH to each control-plane node
2. Create the encryption config file at /etc/kubernetes/enc/enc.yaml:
   apiVersion: apiserver.config.k8s.io/v1
   kind: EncryptionConfiguration
   resources:
   - resources: ["secrets"]
     providers:
     - aescbc:
         keys:
         - name: key1
           secret: <BASE64_32_BYTE_KEY>
     - identity: {}
   
3. Edit /etc/kubernetes/manifests/kube-apiserver.yaml and:
   • Add the flag under the kube-apiserver container command:
     - --encryption-provider-config=/etc/kubernetes/enc/enc.yaml
     
   • Mount the config path:
     volumeMounts:
     - name: enc
       mountPath: /etc/kubernetes/enc
       readOnly: true
     ...
     volumes:
     - name: enc
       hostPath:
         path: /etc/kubernetes/enc
         type: DirectoryOrCreate
     
   Save the file; the kubelet will restart the API server.
4. Repeat on all control-plane nodes.

​

References

• https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#determining-whether-encryption-at-rest-is-already-enabled

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_encryption_provider_config_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks