Kubernetes Secrets performs only Base64 encoding by default rather than encryption, and requires etcd encryption at rest combined with RBAC permission policies to improve security.