[zaat]

It is in your hands (the version where it became available is more than a year end of life, basically forever in Kubernetes life), maybe they will change the default too. At least there's a fine bold warning box in the docs.

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...