Secrets are not encrypted by default in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the default state of Kubernetes Secrets in terms of encryption?

By default, Kubernetes Secrets are stored as base64-encoded strings in etcd, but they are not encrypted at rest.

beginner

Why is it risky to rely on default Kubernetes Secrets storage?

Because Secrets are not encrypted by default, anyone with access to etcd can read sensitive data, risking data exposure.

intermediate

How can you enable encryption for Kubernetes Secrets?

You can enable encryption at rest by configuring the EncryptionConfiguration resource and updating the API server to use it.

beginner

What is the role of etcd in Kubernetes Secrets management?

etcd is the key-value store where Kubernetes stores all cluster data, including Secrets, which by default are stored unencrypted.

beginner

What is base64 encoding and does it provide security for Kubernetes Secrets?

Base64 encoding converts data into text format but does not encrypt it; it only makes data readable by systems, not secure from access.

How are Kubernetes Secrets stored by default?

A Hashed with SHA-256

B Encrypted with AES-256

C Plain text in etcd

D Base64 encoded but not encrypted

Kubernetes stores Secrets base64 encoded in etcd by default, which is not encryption.

What must you configure to encrypt Kubernetes Secrets at rest?

A EncryptionConfiguration and API server flags

B Pod Security Policies

C Network Policies

D RBAC Roles

EncryptionConfiguration resource and API server flags enable encryption of Secrets at rest.

Why is base64 encoding not enough to protect Secrets?

A It compresses data too much

B It only encodes data, does not encrypt it

C It hashes data irreversibly

D It stores data in plain text

Base64 encoding only changes data format; it does not provide confidentiality.

Where are Kubernetes Secrets stored in the cluster?

A In container file system only

B In pod environment variables only

C In etcd key-value store

D In the Kubernetes dashboard

Secrets are stored in etcd, the cluster's key-value store.

What is a simple step to improve Secrets security in Kubernetes?

A Enable encryption at rest for etcd

B Use longer base64 strings

C Store Secrets in ConfigMaps

D Disable RBAC

Enabling encryption at rest protects Secrets stored in etcd.

Explain why Kubernetes Secrets are not secure by default and how you can improve their security.

Think about how Secrets are stored and what encryption means.

Describe the role of etcd in Kubernetes Secrets management and the risks involved.

Consider where Secrets live and who can access them.