Secret types (Opaque, docker-registry, TLS) in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of creating an Opaque secret with kubectl

What is the output of the following command when creating an Opaque secret named mysecret with a literal key-value pair username=admin?

Kubernetes

kubectl create secret generic mysecret --from-literal=username=admin

A Warning: secret/mysecret already exists

B secret/mysecret created

C Error from server (Forbidden): secrets is forbidden: User "system:anonymous" cannot create resource "secrets"

D secret/mysecret deleted

💡 Hint

Think about the normal success message when creating a secret with kubectl.

The command creates an Opaque secret named 'mysecret' with the given literal data. On success, kubectl outputs 'secret/mysecret created'.

🧠 Conceptual

intermediate

Purpose of docker-registry secret type

What is the main purpose of a Kubernetes secret of type kubernetes.io/dockerconfigjson (docker-registry)?

A To store Docker registry credentials for pulling private images

B To store SSH keys for accessing remote servers

C To store generic key-value pairs for application configuration

D To store TLS certificates for secure communication

💡 Hint

Think about what is needed to pull images from private Docker registries.

The docker-registry secret type stores credentials in a special JSON format that Kubernetes uses to authenticate with private container registries when pulling images.

❓ Configuration

advanced

Correct YAML for TLS secret

Which YAML snippet correctly defines a TLS secret named mytlssecret with certificate and key files?

A

apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  name: mytlssecret
data:
  tls.crt: <base64-encoded-cert>
  tls.key: <base64-encoded-key>

B

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: mytlssecret
stringData:
  tls.crt: <plain-cert>
  tls.key: <plain-key>

C

apiVersion: v1
kind: ConfigMap
metadata:
  name: mytlssecret
data:
  tls.crt: <plain-cert>
  tls.key: <plain-key>

D

apiVersion: v1
kind: Secret
type: kubernetes.io/dockerconfigjson
metadata:
  name: mytlssecret
data:
  .dockerconfigjson: <base64-encoded-json>

💡 Hint

TLS secrets require a specific type and base64 encoded data keys named tls.crt and tls.key.

TLS secrets must have type 'kubernetes.io/tls' and contain base64 encoded certificate and key under keys 'tls.crt' and 'tls.key'.

❓ Troubleshoot

advanced

Error when pulling image with docker-registry secret

You created a docker-registry secret and referenced it in your Pod spec, but the Pod fails to pull the private image with an 'unauthorized' error. What is the most likely cause?

A The secret is missing the key '.dockerconfigjson' with correct JSON content

B The TLS certificate in the secret expired

C The secret type is set to 'Opaque' instead of 'kubernetes.io/dockerconfigjson'

D The Pod spec does not reference the secret under imagePullSecrets

💡 Hint

Check if the Pod knows to use the secret for pulling images.

Even if the secret is correct, the Pod must reference it in the imagePullSecrets field to use it for pulling private images.

✅ Best Practice

expert

Best practice for managing TLS secrets in Kubernetes

Which practice is considered best for managing TLS secrets securely in Kubernetes clusters?

A Use Opaque secrets with base64 encoded TLS data and restrict RBAC access

B Store TLS secrets as plain text ConfigMaps for easy access

C Use kubernetes.io/tls secret type and automate certificate renewal with cert-manager

D Embed TLS certificates directly in Pod specs as environment variables

💡 Hint

Think about automation and security combined for TLS management.

Using the TLS secret type with automation tools like cert-manager ensures secure storage and automatic renewal of certificates, which is best practice.