I have been concerned about leaving /etc/kubernetes/admin.conf (i.e. $KUBECONFIG) unencrypted on disk, for it essentially contains a Kubernetes cluster's root credentials, and an intruder could obviously do a lot of harm with those.
So far, I have kept admin.conf encrypted with encfs and have for the most part resorted to unencrypting it (manually) only in cases of emergency (when I could no longer log into the Kubernetes cluster with an administrator OIDC token). This has served well for several years. But the simple encryption layer has its downsides: in particular, it makes cluster upgrades with kubeadm upgrade plan somewhat brittle. I just ran into an error "failed to renew certificate [...] unable to sign certificate admin.conf", which could be related. My current hunch is that I better decommission the encfs-based mechanism and investigate more suitable alternatives.
Hence I am wondering: can Kubernetes Key Management Service (KMS) and its providers (e.g. Thales KSM Plugin) also manage admin.conf encrypted at rest, or do those only have secrets (inside etcd) in their scopes? I suspect the second is the case, but want to be sure, for I am facing an important (re)design decision.
P.S. I also noticed that various security controls (e.g. "C-0104 - Ensure that the admin.conf file permissions are set to 600") make lighter recommendations. So perhaps the "correct" line of thinking is: admin.conf encrypted at rest is too late a line of defense: the focus must be on always keeping intruders off cluster nodes. Or perhaps KSM could not even "bootstrap" with admin.conf being encrypted by itself.
