Secrets are not encrypted by default in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to create a secret named mysecret with a key called password.

Kubernetes

kubectl create secret generic mysecret --from-literal=[1]=mypassword

Drag options to blanks, or click blank then click option'

Apassword

Bkey

Cusername

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using a key that does not match the secret data purpose.

The key for the secret data is usually descriptive, here 'password' fits the example.

2fill in blank

medium

Complete the command to view the secret data in base64 encoding.

Kubernetes

kubectl get secret mysecret -o [1]

Drag options to blanks, or click blank then click option'

Awide

Byaml

Cjson

Djsonpath='{.data.password}'

Attempts:

3 left

💡 Hint

Common Mistakes

Using output formats that show decoded data or metadata only.

The jsonpath option extracts the base64 encoded value of the password key.

3fill in blank

hard

Fix the error in the command to decode the secret password value.

Kubernetes

kubectl get secret mysecret -o jsonpath='{{.data.password}}' | [1] -d

Drag options to blanks, or click blank then click option'

Abase64

Bdecode

Copenssl

Dcat

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect commands that do not decode base64 data.

The 'base64 -d' command decodes the base64 encoded secret value.

4fill in blank

hard

Fill both blanks to enable encryption of secrets at rest in Kubernetes.

Kubernetes

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - [1]:
      keys:
      - name: key1
        [2]: {{"<base64-encoded-key>"}}

Drag options to blanks, or click blank then click option'

Aaescbc

Bidentity

Csecret

Dkey

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'identity' disables encryption, 'secret' is not a valid provider.

'aescbc' is a common encryption provider and 'key' is the field for the encryption key.

5fill in blank

hard

Fill all three blanks to patch the API server manifest to enable encryption.

Kubernetes

spec:
  containers:
  - name: kube-apiserver
    command:
    - kube-apiserver
    - --encryption-provider-config=[1]
    - --authorization-mode=[2]
    - --enable-admission-plugins=[3]

Drag options to blanks, or click blank then click option'

A/etc/kubernetes/encryption-config.yaml

BNode,RBAC

CEncryption,NodeRestriction

DRBAC,NodeRestriction

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong file paths or missing required admission plugins.

The encryption config file path is set, RBAC and NodeRestriction are common authorization and admission plugins, and Encryption admission plugin is enabled.