[Solved] Which of the following is the correct way to enable Secrets encryption at rest in Kubernetes EncryptionConfiguration file? | Kubernetes

Kubernetes - RBAC and Security

Which of the following is the correct way to enable Secrets encryption at rest in Kubernetes EncryptionConfiguration file?

A

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: <base64-encoded-key>
  - identity: {}

B

apiVersion: v1
kind: Secret
metadata:
  name: encryption-config
stringData:
  key: <base64-encoded-key>

C

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- secrets
providers:
- identity: {}
- aescbc:
    keys:
    - name: key1
      secret: <base64-encoded-key>

D

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfig
resources:
- secrets
- aescbc:
    keys:
    - name: key1
      secret: <base64-encoded-key>

Step-by-Step Solution

Solution:

Step 1: Review the correct structure of EncryptionConfiguration
The file must have apiVersion, kind, and a resources list with nested resources and providers. The providers list includes encryption methods like aescbc and identity.
Step 2: Compare options for correct YAML syntax and structure
apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - secrets providers: - identity: {} - aescbc: keys: - name: key1 secret: correctly nests resources and providers, uses aescbc with keys, and includes identity as fallback. apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - resources: - secrets providers: - aescbc: keys: - name: key1 secret: - identity: {} incorrectly nests 'resources' under 'resources'. Others have syntax errors or wrong kind names.
Final Answer:
apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - secrets providers: - identity: {} - aescbc: keys: - name: key1 secret: -> Option C
Quick Check:
Correct YAML structure = apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - secrets providers: - identity: {} - aescbc: keys: - name: key1 secret: [OK]

Quick Trick: Look for 'resources' as a list of resource names and 'providers' as a list of encryption methods [OK]

Common Mistakes:

Using wrong kind name like EncryptionConfig instead of EncryptionConfiguration
Incorrect YAML indentation or missing nested keys
Placing keys outside the providers list
Nesting 'resources' under 'resources' incorrectly

Master "RBAC and Security" in Kubernetes

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

More Kubernetes Quizzes

Which of the following is the correct way to enable Secrets encryption at rest in Kubernetes EncryptionConfiguration file?

Step 1: Review the correct structure of EncryptionConfiguration

Step 2: Compare options for correct YAML syntax and structure

Final Answer:

Quick Check:

Want More Practice?