Secrets are not encrypted by default in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to create a secret named mysecret with a key called password.

Kubernetes

kubectl create secret generic mysecret --from-literal=[1]=mypassword

Drag options to blanks, or click blank then click option'

Apassword

Bkey

Cusername

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using a key that does not match the secret data purpose.

The key for the secret data is usually descriptive, here 'password' fits the example.

2fill in blank

medium

Complete the command to view the secret data in base64 encoding.

Kubernetes

kubectl get secret mysecret -o [1]

Drag options to blanks, or click blank then click option'

Awide

Byaml

Cjson

Djsonpath='{.data.password}'

Attempts:

3 left

💡 Hint

Common Mistakes

Using output formats that show decoded data or metadata only.

The jsonpath option extracts the base64 encoded value of the password key.

3fill in blank

hard

Fix the error in the command to decode the secret password value.

Kubernetes

kubectl get secret mysecret -o jsonpath='{{.data.password}}' | [1] -d

Drag options to blanks, or click blank then click option'

Abase64

Bdecode

Copenssl

Dcat

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect commands that do not decode base64 data.

The 'base64 -d' command decodes the base64 encoded secret value.

4fill in blank

hard

Fill both blanks to enable encryption of secrets at rest in Kubernetes.

Kubernetes

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - [1]:
      keys:
      - name: key1
        [2]: {{"<base64-encoded-key>"}}

Drag options to blanks, or click blank then click option'

Aaescbc

Bidentity

Csecret

Dkey

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'identity' disables encryption, 'secret' is not a valid provider.

'aescbc' is a common encryption provider and 'key' is the field for the encryption key.

5fill in blank

hard

Fill all three blanks to patch the API server manifest to enable encryption.

Kubernetes

spec:
  containers:
  - name: kube-apiserver
    command:
    - kube-apiserver
    - --encryption-provider-config=[1]
    - --authorization-mode=[2]
    - --enable-admission-plugins=[3]

Drag options to blanks, or click blank then click option'

A/etc/kubernetes/encryption-config.yaml

BNode,RBAC

CEncryption,NodeRestriction

DRBAC,NodeRestriction

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong file paths or missing required admission plugins.

The encryption config file path is set, RBAC and NodeRestriction are common authorization and admission plugins, and Encryption admission plugin is enabled.

Practice

1. What is the default way Kubernetes stores Secrets?

easy

A. Hashed using SHA-256 before storage

B. As base64 encoded plain text in etcd

C. Stored in an external vault automatically

D. Encrypted with AES-256 by default

Solution

1. Step 1: Understand Kubernetes default Secret storage

   Kubernetes stores Secrets in etcd as base64 encoded strings, which is not encryption but simple encoding.

2. Step 2: Confirm encryption is not enabled by default

   Encryption at rest must be explicitly configured; by default, Secrets are not encrypted.

3. Final Answer:

   As base64 encoded plain text in etcd -> Option B

4. Quick Check:

   Default Secret storage = base64 plain text [OK]

Hint: Remember: base64 is encoding, not encryption [OK]

Common Mistakes:

• Confusing base64 encoding with encryption
• Assuming Secrets are encrypted by default
• Thinking Kubernetes uses external vault automatically

2. Which of the following is the correct way to enable encryption of Secrets in Kubernetes?

easy

A. Configure EncryptionConfiguration file in API server flags

B. Set encryption: true in the Secret manifest

C. Add --encryption-provider flag to kubelet

D. Use kubectl encrypt secret command

Solution

1. Step 1: Identify where encryption is configured

   Encryption at rest is enabled by configuring the API server with an EncryptionConfiguration file and passing it via flags.

2. Step 2: Verify other options are invalid

   Kubelet does not handle encryption, Secret manifests do not have encryption fields, and kubectl has no encrypt command.

3. Final Answer:

   Configure EncryptionConfiguration file in API server flags -> Option A

4. Quick Check:

   Encryption enabled via API server config [OK]

Hint: Encryption config is on API server, not kubelet or kubectl [OK]

Common Mistakes:

• Trying to encrypt Secrets via kubectl commands
• Assuming kubelet manages encryption
• Adding encryption fields in Secret YAML

3. Given this snippet from an EncryptionConfiguration file:

{
  "kind": "EncryptionConfiguration",
  "apiVersion": "apiserver.config.k8s.io/v1",
  "resources": [
    {
      "resources": ["secrets"],
      "providers": [
        {"aescbc": {"keys": [{"name": "key1", "secret": "c2VjcmV0MTIzNDU2Nzg5MDEyMzQ1Njc4OTA="}]}},
        {"identity": {}}
      ]
    }
  ]
}

What does this configuration do?

medium

A. Encrypts Secrets using AES-CBC with key1, falling back to no encryption

B. Encrypts all resources except Secrets

C. Disables encryption for Secrets

D. Encrypts Secrets using identity provider only

Solution

1. Step 1: Analyze the providers list for Secrets

   The providers list has an AES-CBC encryption provider with a key named key1, followed by identity (no encryption) as fallback.

2. Step 2: Understand the effect on Secrets

   This means Secrets are encrypted with AES-CBC using key1; if decryption fails, identity provider returns plain data.

3. Final Answer:

   Encrypts Secrets using AES-CBC with key1, falling back to no encryption -> Option A

4. Quick Check:

   Encryption config with AES-CBC + identity fallback [OK]

Hint: First provider encrypts, second is fallback identity [OK]

Common Mistakes:

• Thinking identity means encryption is disabled
• Assuming all resources are encrypted, not just Secrets
• Confusing provider order effect

4. You configured encryption for Secrets but still see base64 encoded plain text in etcd. What is the most likely cause?

medium

A. Secrets manifest missing encryption annotation

B. Encryption key is too short

C. kubectl version is outdated

D. API server was not restarted after adding EncryptionConfiguration

Solution

1. Step 1: Check if API server reload is needed

   EncryptionConfiguration changes require API server restart to take effect.

2. Step 2: Verify other options are irrelevant

   Secrets do not need annotations for encryption, kubectl version does not affect encryption, and key length would cause errors, not silent failure.

3. Final Answer:

   API server was not restarted after adding EncryptionConfiguration -> Option D

4. Quick Check:

   API server restart required for encryption config [OK]

Hint: Restart API server after config changes [OK]

Common Mistakes:

• Forgetting to restart API server
• Adding encryption annotations to Secrets
• Blaming kubectl version for encryption issues

5. You want to ensure all Secrets in your cluster are encrypted at rest. Which steps should you follow? Select the correct sequence.

hard

A. Enable encryption in kube-proxy config, restart kube-proxy, check logs

B. Add encryption field to Secret manifests, restart kubelet, verify kubectl output

C. Create EncryptionConfiguration file, update API server flags, restart API server, verify etcd data

D. Run kubectl encrypt secrets, update RBAC, restart API server

Solution

1. Step 1: Prepare EncryptionConfiguration file

   Create a file defining encryption providers for Secrets, typically AES-CBC or AES-GCM.

2. Step 2: Update API server flags and restart

   Pass the EncryptionConfiguration file path to the API server via flags and restart it to apply changes.

3. Step 3: Verify Secrets are encrypted in etcd

   Check etcd data to confirm Secrets are stored encrypted, not just base64 encoded.

4. Final Answer:

   Create EncryptionConfiguration file, update API server flags, restart API server, verify etcd data -> Option C

5. Quick Check:

   Encryption setup = config file + API server restart + verify [OK]

Hint: Encryption needs config file + API server restart + verify [OK]

Common Mistakes:

• Trying to encrypt Secrets via manifest changes
• Restarting wrong components like kubelet or kube-proxy
• Using non-existent kubectl encrypt command