Data at rest should be encrypted using a kms provider: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data