What happened

When creating a cluster with Encryption at Rest enabled via the API/UI, the encryption secret is created in the seed cluster's kubermatic namespace (which doesn't exist in shared environments). It should be created in the master cluster's kubermatic namespace. This causes the cluster to get stuck in the Creating phase because the encryption-secret-synchronizer controller expects the secret in the master cluster.

Expected behavior

The encryption secret should be created in the master cluster's kubermatic namespace. The encryption secret synchronizer will then sync it to the appropriate seed cluster.

How to reproduce

1. Deploy KKP with separate master and seed clusters
2. Create a new user cluster with EAR enabled
3. The cluster gets stuck at Creating phase

Current workaround

Manually create the encryption secret in the master cluster's kubermatic namespace.