Is there downtime when enabling Kubernetes secret encryption in a cluster?

No, I believe there is no downtime when enabling Kubernetes secret encryption in an EKS cluster. You can enable secret encryption on an existing EKS cluster without any downtime.

Just a warning, You can't disable the secrets encryption after enabling it.

Enabling KMS encryption on the existing EKS cluster using the new KMS Key. You have two options:

• To automatically re-encrypt your secrets
• To opt out of automatically re-encrypting your secrets

You can read more about Enabling Secrets encryption on existing EKS Cluster here:

1. https://docs.aws.amazon.com/eks/latest/userguide/enable-kms.html
2. https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/
3. https://eksctl.io/usage/kms-encryption/#enabling-kms-encryption-on-an-existing-cluster