The Submariner CR exposes a string field for the IPsec pre-shared key. Custom Resources are stored unencrypted in etcd by default (only v1/Secret is encrypted by the OCP KMS provider), are returned by kubectl get submariner -o yaml to anyone with get on the namespaced CR, and are commonly captured in GitOps repos / must-gather bundles. The PSK is identical across all clusters in the mesh, so disclosure on one spoke enables passive decryption of traffic between any two spokes.

Source: Project Glasswing AI-SAST audit of submariner-io/submariner-operator. Finding ID: FIND-003 Assurance: executionproven