Creating Secrets in Kubernetes - Practice Exercises

Challenge - 5 Problems

💻 Command Output

intermediate

Output of kubectl create secret generic command

What is the output of this command when creating a secret named mysecret with a literal key-value pair?

Kubernetes

kubectl create secret generic mysecret --from-literal=username=admin

A secret/mysecret created

B error: resource not found

C secret/mysecret updated

D error: invalid syntax

💡 Hint

Think about what kubectl reports when a new secret is successfully created.

The command creates a new secret named 'mysecret' and kubectl outputs 'secret/mysecret created' to confirm success.

🧠 Conceptual

intermediate

Base64 encoding in Kubernetes Secrets

Why does Kubernetes require secret data to be base64 encoded in YAML manifest files?

A To compress the secret data for faster transmission

B To ensure the data is encrypted at rest

C To allow binary data to be safely stored in text files

D To convert data into a human-readable format

💡 Hint

Think about how YAML files handle binary or special characters.

Base64 encoding allows binary or special characters to be safely represented as plain text in YAML files, avoiding parsing errors.

❓ Configuration

advanced

Correct YAML for a Kubernetes Secret with two keys

Which YAML manifest correctly creates a secret named db-secret with keys username and password base64 encoded?

A

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
data:
  username: admin
  password: password

B

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

C

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
stringData:
  username: admin
  password: password

D

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
stringData:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

💡 Hint

Check which field requires base64 encoded values and which accepts plain text.

The 'data' field requires base64 encoded values. Option B correctly uses 'data' with base64 encoded strings. Option B uses 'stringData' with plain text, which is valid but does not match the question requirement for base64 encoded keys.

❓ Troubleshoot

advanced

Troubleshooting secret not found error in Pod

A Pod fails to start with error: secret "mysecret" not found. Which is the most likely cause?

A The secret was created in a different namespace than the Pod

B The secret data is not base64 encoded

C The secret name contains uppercase letters

D The Pod spec does not include a volume mount

💡 Hint

Remember that Kubernetes resources are namespace-scoped unless specified otherwise.

Secrets are namespace-scoped. If the Pod is in a different namespace than the secret, it cannot access it, causing the 'not found' error.

🔀 Workflow

expert

Order of steps to update a Kubernetes Secret safely

What is the correct order of steps to update a Kubernetes Secret without downtime for Pods using it?

A 1,4,2,3

B 2,1,3,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Think about how to avoid downtime by updating secrets and Pods in a controlled sequence.

First create a new secret with a new name, then update Pod specs to use it, apply the changes to trigger rolling update, and finally delete the old secret once Pods use the new one.