etcd stores all cluster state, including Secrets. Directly accessing etcd bypasses all RBAC controls. By default, Secrets in etcd are not encrypted at rest.