Without encryption at rest, etcd stores Secrets in plaintext on disk. Anyone with access to the etcd data directory or etcd backup files can read all Secrets without needing Kubernetes authentication or RBAC permissions.