[dharmab]

They're not necessarily strings. You can put binary data in the data field, which is why it is base64.

You can also configure the apiserver/etcd to encrypt specific keyspaces, such as the secrets/ key space.