External secret management integration in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Kubernetes Secret.

Kubernetes

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
stringData:
  password: [1]

Drag options to blanks, or click blank then click option'

AsecretKeyRef

BexternalSecretRef

CmyPassword123

DconfigMapRef

Attempts:

3 left

💡 Hint

Common Mistakes

Using a reference like 'secretKeyRef' instead of the actual secret value.

Confusing ConfigMap references with secrets.

The stringData field requires the actual secret value, so myPassword123 is correct here.

2fill in blank

medium

Complete the ExternalSecret manifest to specify the secret store provider.

Kubernetes

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: my-secret-store
    kind: [1]

Drag options to blanks, or click blank then click option'

AClusterSecretStore

BSecret

CConfigMap

DExternalSecret

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Secret' or 'ConfigMap' as the kind, which are not secret stores.

Confusing ExternalSecret kind with secret store kind.

The secretStoreRef.kind must be ClusterSecretStore or SecretStore. Here, ClusterSecretStore is correct.

3fill in blank

hard

Fix the error in the ExternalSecret spec to correctly map the external secret key to the Kubernetes secret key.

Kubernetes

spec:
  target:
    name: my-secret
  data:
  - secretKey: password
    remoteRef:
      key: [1]

Drag options to blanks, or click blank then click option'

Adb-password

Bpassword

Cmy-secret

DsecretKey

Attempts:

3 left

💡 Hint

Common Mistakes

Using the Kubernetes secret key name instead of the external secret key.

Using generic terms like 'secretKey' instead of the actual external key.

The remoteRef.key must match the key name in the external secret store, such as db-password.

4fill in blank

hard

Fill both blanks to configure the SecretStore to use AWS Secrets Manager with the correct provider and region.

Kubernetes

spec:
  provider:
    [1]:
      region: [2]

Drag options to blanks, or click blank then click option'

Aaws

Bus-west-2

Cgcp

Deurope-west1

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'gcp' as provider for AWS Secrets Manager.

Using incorrect region names.

The provider for AWS Secrets Manager is aws, and the region must be a valid AWS region like us-west-2.

5fill in blank

hard

Fill all three blanks to define an ExternalSecret that fetches a secret named 'api-key' from HashiCorp Vault with the correct path and key mapping.

Kubernetes

spec:
  secretStoreRef:
    name: vault-secret-store
    kind: SecretStore
  target:
    name: vault-api-key
  data:
  - secretKey: [1]
    remoteRef:
      key: [2]
      property: [3]

Drag options to blanks, or click blank then click option'

AapiKey

Bsecret/data/api-key

Cvalue

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up secretKey and remoteRef.key values.

Using incorrect Vault paths or property names.

The Kubernetes secret key is apiKey. The Vault path is secret/data/api-key, and the property inside the secret is value.

Practice

1. What is the main purpose of using ExternalSecret in Kubernetes?

easy

A. To sync secrets from external secret stores into Kubernetes automatically

B. To create new Kubernetes namespaces

C. To monitor pod resource usage

D. To deploy applications without containers

Solution

1. Step 1: Understand ExternalSecret role

   ExternalSecret is designed to fetch and sync secrets from external secret management systems into Kubernetes.

2. Step 2: Compare options with purpose

   Only To sync secrets from external secret stores into Kubernetes automatically describes syncing secrets automatically, which matches ExternalSecret's main use.

3. Final Answer:

   To sync secrets from external secret stores into Kubernetes automatically -> Option A

4. Quick Check:

   ExternalSecret syncs external secrets = C [OK]

Hint: ExternalSecret = syncing external secrets into Kubernetes [OK]

Common Mistakes:

• Confusing ExternalSecret with namespace creation
• Thinking it manages pods or deployments
• Assuming it monitors resource usage

2. Which of the following is the correct syntax to define an ExternalSecret resource in Kubernetes?

easy

A. apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
name: my-secret
spec:
refreshInterval: 1h
secretStoreRef:
name: my-store
target:
name: synced-secret
data:
- secretKey: password
remoteRef:
key: prod/db-password

B. apiVersion: v1
kind: Secret
metadata:
name: my-secret
stringData:
password: prod/db-password

C. apiVersion: apps/v1
kind: Deployment
metadata:
name: secret-deployment
spec:
replicas: 1

D. apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
name: my-secret-store

Solution

1. Step 1: Identify ExternalSecret resource structure

   ExternalSecret uses apiVersion external-secrets.io/v1alpha1, kind ExternalSecret, and spec with secretStoreRef and data fields.

2. Step 2: Match syntax with options

   apiVersion: external-secrets.io/v1alpha1 kind: ExternalSecret metadata: name: my-secret spec: refreshInterval: 1h secretStoreRef: name: my-store target: name: synced-secret data: - secretKey: password remoteRef: key: prod/db-password matches the correct syntax for ExternalSecret resource definition including refreshInterval, secretStoreRef, and data mapping.

3. Final Answer:

   Correct ExternalSecret resource syntax -> Option A

4. Quick Check:

   ExternalSecret syntax = apiVersion: external-secrets.io/v1alpha1 kind: ExternalSecret metadata: name: my-secret spec: refreshInterval: 1h secretStoreRef: name: my-store target: name: synced-secret data: - secretKey: password remoteRef: key: prod/db-password [OK]

Hint: Look for apiVersion external-secrets.io and kind ExternalSecret [OK]

Common Mistakes:

• Using Secret kind instead of ExternalSecret
• Confusing SecretStore with ExternalSecret
• Wrong apiVersion or missing spec fields

3. Given this ExternalSecret YAML snippet, what will be the name of the Kubernetes Secret created?

spec:
  target:
    name: app-secret
  data:
  - secretKey: api-key
    remoteRef:
      key: prod/api-key

medium

A. prod/api-key

B. external-secret

C. api-key

D. app-secret

Solution

1. Step 1: Understand target.name in ExternalSecret

   The target.name field specifies the name of the Kubernetes Secret that will be created or updated.

2. Step 2: Identify the value in target.name

   Here, target.name is set to "app-secret", so the Kubernetes Secret will be named "app-secret".

3. Final Answer:

   app-secret -> Option D

4. Quick Check:

   target.name sets Secret name = app-secret [OK]

Hint: target.name is the Kubernetes Secret name [OK]

Common Mistakes:

• Confusing remoteRef.key with Secret name
• Using secretKey as Secret name
• Assuming default name external-secret

4. You applied an ExternalSecret manifest but the Kubernetes Secret is not created. Which is the most likely cause?

medium

A. The pod does not have enough CPU resources

B. The Kubernetes API server is down

C. The ExternalSecret controller is not installed or running in the cluster

D. The Deployment spec is missing replicas

Solution

1. Step 1: Identify role of ExternalSecret controller

   The ExternalSecret controller watches ExternalSecret resources and creates Kubernetes Secrets accordingly.

2. Step 2: Analyze why Secret is not created

   If the controller is missing or not running, ExternalSecret resources won't be processed, so no Secrets are created.

3. Final Answer:

   The ExternalSecret controller is not installed or running in the cluster -> Option C

4. Quick Check:

   Missing controller = no Secret creation [OK]

Hint: Check if ExternalSecret controller pod is running [OK]

Common Mistakes:

• Blaming pod CPU resources for Secret creation
• Assuming API server downtime without checking
• Confusing Deployment replicas with secret syncing

5. You want to sync a secret from AWS Secrets Manager into Kubernetes using ExternalSecret. Which two key configurations must you include in your ExternalSecret manifest?

hard

A. podSelector to select pods and replicas for scaling

B. secretStoreRef to specify AWS Secrets Manager and data with remoteRef key

C. container image and command to run the sync

D. nodeSelector to assign nodes and tolerations for scheduling

Solution

1. Step 1: Identify required ExternalSecret fields for AWS integration

   You must specify secretStoreRef to point to the AWS Secrets Manager store and data with remoteRef key to map the secret key.

2. Step 2: Exclude unrelated fields

   podSelector, replicas, container image, nodeSelector, and tolerations are unrelated to ExternalSecret syncing secrets.

3. Final Answer:

   secretStoreRef to specify AWS Secrets Manager and data with remoteRef key -> Option B

4. Quick Check:

   secretStoreRef + data.remoteRef = AWS secret sync [OK]

Hint: Use secretStoreRef and data.remoteRef for external secrets [OK]

Common Mistakes:

• Confusing pod or node selectors with secret syncing
• Trying to specify container image in ExternalSecret
• Missing secretStoreRef or data fields