etcd encryption

The etcd database, by default, is not encrypted. However, you can easily enable etcd encryption to have an extra layer of data security in your cluster. When etcd encryption is enabled, things such as secrets and config maps are stored encrypted, which makes your cluster even more secure.

To enable etcd encryption, proceed as follows:

1. Edit the apiserver object, like so:

   $ oc edit apiserver

2. Set the encryption field, as follows:

   spec:
     encryption:
       type: aescbc

3. Save the file to apply the changes.

Note that it may take up to 15 minutes or so to enable the encryption after you have applied the changes.