“By default, the identity provider is used to protect secrets in etcd, which provides no encryption.”

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/