Merge pull request #20922 from sftim/20200512_fix_markdown_encryption_at_rest

Fix shortcodes in “Encrypting Secret Data at Rest”

content/en/docs/tasks/administer-cluster/encrypt-data.md

@@ -117,7 +117,7 @@ To create a new secret perform the following steps:
 
 1. Generate a 32 byte random key and base64 encode it. If you're on Linux or macOS, run the following command:
 
-    ```
+   ```shell
    head -c 32 /dev/urandom | base64
    ```
 
@@ -138,21 +138,21 @@ program to retrieve the contents of your secret.
 
 1. Create a new secret called `secret1` in the `default` namespace:
 
-    ```
+   ```shell
    kubectl create secret generic secret1 -n default --from-literal=mykey=mydata
    ```
 
 2. Using the etcdctl commandline, read that secret out of etcd:
 
-    ```
-    ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C
-    ```
+   `ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C`
 
    where `[...]` must be the additional arguments for connecting to the etcd server.
+
 3. Verify the stored secret is prefixed with `k8s:enc:aescbc:v1:` which indicates the `aescbc` provider has encrypted the resulting data.
+
 4. Verify the secret is correctly decrypted when retrieved via the API:
 
-    ```
+   ```shell
    kubectl describe secret secret1 -n default
    ```
 
@@ -164,13 +164,16 @@ program to retrieve the contents of your secret.
 
 Since secrets are encrypted on write, performing an update on a secret will encrypt that content.
 
-```
+```shell
 kubectl get secrets --all-namespaces -o json | kubectl replace -f -
 ```
 
 The command above reads all secrets and then updates them to apply server side encryption.
+
+{{< note >}}
 If an error occurs due to a conflicting write, retry the command.
 For larger clusters, you may wish to subdivide the secrets by namespace or script an update.
+{{< /note >}}
 
 
 ## Rotating a decryption key
@@ -206,7 +209,10 @@ resources:
           secret: <BASE 64 ENCODED SECRET>
 ```
 
-and restart all `kube-apiserver` processes. Then run the command `kubectl get secrets --all-namespaces -o json | kubectl replace -f -`
+and restart all `kube-apiserver` processes. Then run:
+```shell
+kubectl get secrets --all-namespaces -o json | kubectl replace -f -
+```
 to force all secrets to be decrypted.
 
 {{% /capture %}}