Kubernetes Secrets are base64-encoded, not encrypted. This is a common misconception; base64 is an encoding scheme that provides no confidentiality. Encryption at rest must be explicitly configured.