Creating Secrets in Kubernetes - Practice Exercises

Challenge - 5 Problems

💻 Command Output

intermediate

Output of kubectl create secret generic command

What is the output of this command when creating a secret named mysecret with a literal key-value pair?

Kubernetes

kubectl create secret generic mysecret --from-literal=username=admin

A secret/mysecret created

B error: resource not found

C secret/mysecret updated

D error: invalid syntax

💡 Hint

Think about what kubectl reports when a new secret is successfully created.

The command creates a new secret named 'mysecret' and kubectl outputs 'secret/mysecret created' to confirm success.

🧠 Conceptual

intermediate

Base64 encoding in Kubernetes Secrets

Why does Kubernetes require secret data to be base64 encoded in YAML manifest files?

A To compress the secret data for faster transmission

B To ensure the data is encrypted at rest

C To allow binary data to be safely stored in text files

D To convert data into a human-readable format

💡 Hint

Think about how YAML files handle binary or special characters.

Base64 encoding allows binary or special characters to be safely represented as plain text in YAML files, avoiding parsing errors.

❓ Configuration

advanced

Correct YAML for a Kubernetes Secret with two keys

Which YAML manifest correctly creates a secret named db-secret with keys username and password base64 encoded?

A

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
data:
  username: admin
  password: password

B

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

C

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
stringData:
  username: admin
  password: password

D

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
stringData:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

💡 Hint

Check which field requires base64 encoded values and which accepts plain text.

The 'data' field requires base64 encoded values. Option B correctly uses 'data' with base64 encoded strings. Option B uses 'stringData' with plain text, which is valid but does not match the question requirement for base64 encoded keys.

❓ Troubleshoot

advanced

Troubleshooting secret not found error in Pod

A Pod fails to start with error: secret "mysecret" not found. Which is the most likely cause?

A The secret was created in a different namespace than the Pod

B The secret data is not base64 encoded

C The secret name contains uppercase letters

D The Pod spec does not include a volume mount

💡 Hint

Remember that Kubernetes resources are namespace-scoped unless specified otherwise.

Secrets are namespace-scoped. If the Pod is in a different namespace than the secret, it cannot access it, causing the 'not found' error.

🔀 Workflow

expert

Order of steps to update a Kubernetes Secret safely

What is the correct order of steps to update a Kubernetes Secret without downtime for Pods using it?

A 1,4,2,3

B 2,1,3,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Think about how to avoid downtime by updating secrets and Pods in a controlled sequence.

First create a new secret with a new name, then update Pod specs to use it, apply the changes to trigger rolling update, and finally delete the old secret once Pods use the new one.

Practice

1. What is the main purpose of creating a Secret in Kubernetes?

easy

A. To store sensitive information like passwords and tokens securely

B. To create a backup of your application data

C. To increase the number of pods in a deployment

D. To monitor the health of your cluster nodes

Solution

1. Step 1: Understand what Secrets are for

   Secrets in Kubernetes are designed to hold sensitive data such as passwords, tokens, or keys safely.

2. Step 2: Compare options with the purpose

   Only To store sensitive information like passwords and tokens securely describes storing sensitive info securely, which matches the purpose of Secrets.

3. Final Answer:

   To store sensitive information like passwords and tokens securely -> Option A

4. Quick Check:

   Secrets store sensitive info = B [OK]

Hint: Secrets = safe storage for sensitive data [OK]

Common Mistakes:

• Confusing Secrets with backups
• Thinking Secrets manage pods or nodes
• Assuming Secrets are for monitoring

2. Which of the following is the correct command to create a generic secret named mysecret with a literal key-value pair username=admin?

easy

A. kubectl create secret generic mysecret --from-literal=username=admin

B. kubectl secret create generic mysecret --literal=username=admin

C. kubectl create secret mysecret --literal username=admin

D. kubectl create secret generic mysecret username=admin

Solution

1. Step 1: Recall the correct syntax for creating a generic secret

   The correct command uses kubectl create secret generic [name] --from-literal=key=value.

2. Step 2: Match the options with the correct syntax

   Only kubectl create secret generic mysecret --from-literal=username=admin matches the exact syntax with correct flags and order.

3. Final Answer:

   kubectl create secret generic mysecret --from-literal=username=admin -> Option A

4. Quick Check:

   Correct syntax uses --from-literal=key=value = D [OK]

Hint: Use --from-literal=key=value with create secret generic [OK]

Common Mistakes:

• Using wrong flag names like --literal
• Omitting 'generic' keyword
• Incorrect order of arguments

3. What will be the output of the command kubectl get secret mysecret -o yaml after creating a secret with kubectl create secret generic mysecret --from-literal=password=pass123?

medium

A. The secret will not appear in the output

B. The password will be shown in plain text under data field

C. The password will be base64 encoded under data field

D. An error will occur because secrets cannot be viewed

Solution

1. Step 1: Understand how Kubernetes stores secret data

   Kubernetes stores secret values base64 encoded in the data field when viewed in YAML or JSON.

2. Step 2: Analyze the command output

   The command shows the secret in YAML format with the password base64 encoded, not plain text.

3. Final Answer:

   The password will be base64 encoded under data field -> Option C

4. Quick Check:

   Secrets data is base64 encoded = A [OK]

Hint: Secrets data shown base64 encoded, not plain text [OK]

Common Mistakes:

• Expecting plain text output
• Thinking secrets are hidden completely
• Assuming error when viewing secrets

4. You tried to create a secret with the command kubectl create secret generic mysecret --from-literal password pass123 but got an error. What is the likely cause?

medium

A. You need to add --type=generic flag explicitly

B. Secret name 'mysecret' is invalid

C. The password value is too short

D. Missing '=' sign between key and value in --from-literal

Solution

1. Step 1: Check the syntax of --from-literal flag

   The correct syntax requires an '=' sign between key and value, like --from-literal=key=value.

2. Step 2: Identify the error in the command

   The command uses a space instead of '=', causing a syntax error.

3. Final Answer:

   Missing '=' sign between key and value in --from-literal -> Option D

4. Quick Check:

   --from-literal needs '=' between key and value = A [OK]

Hint: Use '=' in --from-literal key=value, no spaces [OK]

Common Mistakes:

• Using space instead of '=' in --from-literal
• Assuming secret name rules cause error
• Thinking --type=generic is mandatory

5. You want to create a secret from a file named config.txt and also add a literal key env=prod. Which command correctly does this?

hard

A. kubectl create secret generic appsecret --from-file=config.txt env=prod

B. kubectl create secret generic appsecret --from-file=config.txt --from-literal=env=prod

C. kubectl create secret generic appsecret --from-literal=config.txt --from-literal=env=prod

D. kubectl create secret generic appsecret --from-file=config.txt --literal=env=prod

Solution

1. Step 1: Understand how to add file and literal to secret

   Use --from-file=filename to add file content and --from-literal=key=value for literals.

2. Step 2: Check options for correct syntax

   kubectl create secret generic appsecret --from-file=config.txt --from-literal=env=prod correctly uses both flags with proper syntax; others misuse flags or omit '='.

3. Final Answer:

   kubectl create secret generic appsecret --from-file=config.txt --from-literal=env=prod -> Option B

4. Quick Check:

   Use --from-file and --from-literal together correctly = C [OK]

Hint: Combine --from-file and --from-literal with '=' correctly [OK]

Common Mistakes:

• Using --from-literal for file instead of --from-file
• Omitting '=' in --from-literal
• Mixing flags incorrectly