Secret types (Opaque, docker-registry, TLS) in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a generic secret with kubectl.

Kubernetes

kubectl create secret [1] mysecret --from-literal=username=admin

Drag options to blanks, or click blank then click option'

Adocker-registry

Bgeneric

Ctls

Dconfigmap

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'docker-registry' instead of 'generic' for generic secrets.

The generic secret type is used for generic secrets with arbitrary key-value pairs.

2fill in blank

medium

Complete the code to create a docker-registry secret with kubectl.

Kubernetes

kubectl create secret [1] regsecret --docker-username=user --docker-password=pass --docker-server=myregistry.com

Drag options to blanks, or click blank then click option'

Adocker-registry

Bopaque

Ctls

Dgeneric

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'generic' instead of 'docker-registry' for Docker credentials.

The docker-registry secret type stores credentials for accessing private Docker registries.

3fill in blank

hard

Fix the error in the command to create a TLS secret.

Kubernetes

kubectl create secret tls mytlssecret --cert=[1] --key=key.pem

Drag options to blanks, or click blank then click option'

Aca.crt

Btls.key

Ctls.crt

Dcert.pem

Attempts:

3 left

💡 Hint

Common Mistakes

Using the private key file for the --cert flag.

The --cert flag expects the path to the certificate file, commonly named tls.crt.

4fill in blank

hard

Fill both blanks to create a TLS secret with correct file names.

Kubernetes

kubectl create secret tls mytlssecret --cert=[1] --key=[2]

Drag options to blanks, or click blank then click option'

Acert.pem

Bkey.pem

Ctls.crt

Dtls.key

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping certificate and key file names.

The --cert flag should point to the certificate file (e.g., tls.crt) and --key to the private key file (e.g., tls.key).

5fill in blank

hard

Fill all three blanks to create an opaque secret with username and password.

Kubernetes

kubectl create secret [1] mysecret --from-literal=[2]=admin --from-literal=[3]=1234

Drag options to blanks, or click blank then click option'

Ageneric

Busername

Cpassword

Ddocker-registry

Attempts:

3 left

💡 Hint

Common Mistakes

Using docker-registry type for generic secrets.

Use generic for generic secrets, and specify keys like username and password with their values.

Practice

1. Which Kubernetes secret type is best suited for storing general sensitive data like passwords or tokens?

easy

A. Opaque

B. docker-registry

C. TLS

D. ConfigMap

Solution

1. Step 1: Understand secret types

   Opaque secrets are designed to store arbitrary user-defined data such as passwords or tokens.

2. Step 2: Compare with other types

   docker-registry is for Docker credentials, TLS is for certificates, and ConfigMap is not a secret type.

3. Final Answer:

   Opaque -> Option A

4. Quick Check:

   General sensitive data = Opaque [OK]

Hint: Opaque = general secret data, docker-registry = Docker creds [OK]

Common Mistakes:

• Confusing TLS secrets with general data storage
• Using docker-registry for non-Docker secrets
• Thinking ConfigMap is a secret type

2. Which kubectl command correctly creates a docker-registry secret named myregistrykey with username user1 and password pass123?

easy

A. kubectl create secret docker-registry myregistrykey --docker-server=https://myregistry.com --docker-username=user1 --docker-password=pass123

B. kubectl create secret generic myregistrykey --docker-username=user1 --docker-password=pass123

C. kubectl create secret tls myregistrykey --docker-username=user1 --docker-password=pass123

D. kubectl create secret docker-registry myregistrykey --username=user1 --password=pass123

Solution

1. Step 1: Identify correct secret type and flags

   docker-registry secrets require the type 'docker-registry' and flags --docker-server, --docker-username and --docker-password.

2. Step 2: Check command syntax

   kubectl create secret docker-registry myregistrykey --docker-server=https://myregistry.com --docker-username=user1 --docker-password=pass123 uses correct type and flags; others use wrong types or flag names.

3. Final Answer:

   kubectl create secret docker-registry myregistrykey --docker-server=https://myregistry.com --docker-username=user1 --docker-password=pass123 -> Option A

4. Quick Check:

   docker-registry + --docker-server/--docker-username/password = correct [OK]

Hint: Use --docker-server, --docker-username and --docker-password with docker-registry type [OK]

Common Mistakes:

• Using generic secret type for docker-registry secrets
• Wrong flag names like --username instead of --docker-username
• Using TLS secret type for docker credentials

3. Given the command kubectl create secret tls mytlssecret --cert=cert.pem --key=key.pem, what will be the type of the created secret?

medium

A. Opaque

B. docker-registry

C. TLS

D. generic

Solution

1. Step 1: Analyze the command

   The command uses 'create secret tls' with certificate and key files specified.

2. Step 2: Match secret type

   Secrets created with 'tls' type store TLS certificates and keys, so the type is TLS.

3. Final Answer:

   TLS -> Option C

4. Quick Check:

   kubectl create secret tls = TLS type secret [OK]

Hint: TLS secrets use 'kubectl create secret tls' with cert and key [OK]

Common Mistakes:

• Assuming TLS secrets are Opaque
• Confusing generic secret type with TLS
• Not specifying cert and key files properly

4. You run kubectl create secret tls mytlssecret --cert=cert.pem but get an error. What is the likely cause?

medium

A. Using wrong secret type, should be opaque

B. Missing --key flag with private key file

C. Certificate file is empty

D. Secret name contains invalid characters

Solution

1. Step 1: Check required flags for TLS secret

   Creating TLS secrets requires both --cert and --key flags to specify certificate and private key files.

2. Step 2: Identify missing flag

   The command only has --cert but lacks --key, causing the error.

3. Final Answer:

   Missing --key flag with private key file -> Option B

4. Quick Check:

   Both --cert and --key required for TLS secret [OK]

Hint: TLS secrets need both --cert and --key flags [OK]

Common Mistakes:

• Omitting the --key flag when creating TLS secrets
• Using opaque type instead of TLS for certs
• Assuming secret name format causes error

5. You want to pull images from a private Docker registry in your Kubernetes cluster. Which secret type should you create and how should you use it in a Pod spec?

hard

A. Create a TLS secret and add it to the Pod's environment variables

B. Create an opaque secret and mount it as a volume in the Pod

C. Create a generic secret and specify it in the Pod's volumes section

D. Create a docker-registry secret and reference it in imagePullSecrets of the Pod

Solution

1. Step 1: Identify secret type for private Docker registry

   docker-registry secret stores Docker credentials for private registries.

2. Step 2: Use secret in Pod spec

   To allow image pull, reference the secret in the Pod's imagePullSecrets field.

3. Final Answer:

   Create a docker-registry secret and reference it in imagePullSecrets of the Pod -> Option D

4. Quick Check:

   Private Docker registry = docker-registry secret + imagePullSecrets [OK]

Hint: Use docker-registry secret with imagePullSecrets in Pod spec [OK]

Common Mistakes:

• Mounting docker-registry secrets as volumes instead of imagePullSecrets
• Using opaque or TLS secrets for Docker registry auth
• Not referencing the secret in Pod spec