Every secret in the lab prints in four commands, while kubectl describe shows just a byte count and creates the impression that something is hidden. k3s reports encryption at rest disabled and the plaintext password is present in state.db, so one node disk carries the whole cluster's secrets, and inside the pod they are ordinary environment variables visible to exec, /proc and crash dumps.
The default service account cannot read secrets, which makes RBAC the one control doing real work here and the thing worth tightening.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
