Is there downtime when enabling Kubernetes secret encryption in a cluster?

Question

We will enable Kubernetes secret encryption in Production environment. However, our dev environment already set Kubernetes encryption to enabled. So we cannot test if there's downtime when enabling Kubernetes secret encryption.
This is for preparation and comms to user.

Answer

No, I believe there is no downtime when enabling Kubernetes secret encryption in an EKS cluster. You can enable secret encryption on an existing EKS cluster without any downtime.

Just a warning, You can't disable the secrets encryption after enabling it.

Enabling KMS encryption on the existing EKS cluster using the new KMS Key. You have two options:
* To automatically re-encrypt your secrets
* To opt out of automatically re-encrypting your secrets

You can read more about Enabling Secrets encryption on existing EKS Cluster here: 
1. https://docs.aws.amazon.com/eks/latest/userguide/enable-kms.html
2. https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/
3. https://eksctl.io/usage/kms-encryption/#enabling-kms-encryption-on-an-existing-cluster

Is there downtime when enabling Kubernetes secret encryption in a cluster?

Relevanter Inhalt