etcd stores every Kubernetes Secret and cluster state — by default, without encryption. This guide covers enabling encryption at rest, verifying mTLS between control plane components, and scanning for credential leaks to lock down the most critical layer of your cluster.