This message was deleted.

It depends on what distro you’re deploying. RKE2 natively encrypts Secrets, to there isn’t anything you have to do there. For K3s, you can use

secrets-encryption: true

in machine_global_config. For RKE, there is a

secrets_encryption_config

as a kube_api server argument.