talos
talos copied to clipboard
Consider using secretbox instead of aescbc for etcd encryption
Feature Request
Description
Talos currently uses the aescbc provider for etcd encryption.
The official documentation does not recommend using this anymore due to it being vulnerable to padding oracle attacks and thus rates it as "Weak". A newer option would be secretbox, which is currently rated "Strong" in the Kubernetes documentation
More Information
- https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers