---
title: "Encrypt secrets"
slug: "k8s-k8suse-secret-encryption"
updated: 2026-09-17T09:33:15Z
published: 2026-09-17T09:33:15Z
canonical: "guide.ncloud-docs.com/k8s-k8suse-secret-encryption"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Encrypt secrets

Available in VPC

Ncloud Kubernetes Service uses NCP [Key Management Service (KMS)](/docs/en/kms-overview) and Kubernetes' [Encrypting Confidential Data at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) to encrypt secrets stored in etcd.

## Service limits

- Supported from Kubernetes version 1.28 or later
  - To use clusters in earlier versions than 1.28, you must install the required version using the upgrade function.
- Once secret encryption is enabled, it cannot be disabled or changed.

              Caution

              

If you delete the KMS key in use, you cannot recover cluster's secrets.

## Prerequisites

- A key must be generated in NCP KMS.
- The key is intended for encryption/decryption (AES-256), and convergent encryption must be disabled
- To view KMS key information, you must add the following permissions for the SubAccount.
  - Service: Key Management Service
    - Actions: View/getKeyList, View/getKeyInfo

## Secret encryption settings (when creating a cluster)

1. In **Ncloud Kubernetes Service > Clusters**, click the **[Create]** button.
2. Select **[Set]** in **Secret Encryption**.
3. Select the key to use in Secret Encryption.
4. Create the cluster after completing the cluster settings.

## Secret encryption settings (for existing clusters)

1. In **Ncloud Kubernetes Service > Clusters > Details > Secret Encryption**, click the **[Set]** button.
2. Select the key to use for Secret Encryption and click the **[OK]** button.
3. The cluster status will change to **Configuring**, and Secret Encryption settings will be applied.
4. When Secret Encryption settings are complete, the cluster status will change to **Running**.
5. For existing clusters with Secret Encryption set, you must re-encrypt existing secrets using the new encryption key.

```
$ kubectl get secrets --all-namespaces -o json | kubectl replace -f -
```

## Rotate keys

- For the KMS key, it is recommended to periodically [rotate the key](/docs/en/kms-use#%ED%82%A4%ED%9A%8C%EC%A0%84) for enhanced security.
- If the KMS key is rotated, existing secrets are encrypted with the previous version of the key.
- When the KMS key is rotated, newly created secrets are encrypted with the new key, but existing secrets must be re-encrypted.

```
$ kubectl get secrets --all-namespaces -o json | kubectl replace -f -
```