Secrets encryption at rest in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Secrets encryption at rest in Kubernetes?

It means protecting secret data stored on disk by encrypting it, so if someone accesses the storage, they cannot read the secrets without the encryption key.

beginner

Which Kubernetes component manages Secrets encryption at rest?

The Kubernetes API server handles encryption and decryption of secrets when storing or retrieving them from etcd.

beginner

Name the file where Kubernetes stores secrets that can be encrypted at rest.

Secrets are stored in etcd, the key-value store used by Kubernetes.

intermediate

What is the purpose of the EncryptionConfiguration file in Kubernetes?

It tells the API server how to encrypt secrets at rest, including which encryption providers and keys to use.

intermediate

List one common encryption provider used for Kubernetes secrets encryption at rest.

One common provider is aescbc, which uses AES encryption in CBC mode.

Where are Kubernetes secrets stored when encrypted at rest?

A In the container image

B In the pod's environment variables

C In the etcd key-value store

D On the user's local machine

Kubernetes stores secrets in etcd, which can be encrypted at rest to protect the data.

Which Kubernetes component is responsible for encrypting secrets before saving them?

A API server

B Scheduler

C Controller manager

D Kubelet

The API server encrypts secrets before storing them in etcd.

What file configures the encryption method for Kubernetes secrets at rest?

A Dockerfile

B kubeconfig file

C Pod manifest file

D EncryptionConfiguration file

The EncryptionConfiguration file defines how secrets are encrypted at rest.

Which encryption provider is commonly used for Kubernetes secrets encryption?

A rsa

B aescbc

C sha256

D md5

aescbc is a common encryption provider used for encrypting secrets at rest in Kubernetes.

Why is encrypting secrets at rest important?

A To protect secrets if storage is accessed by unauthorized users

B To speed up pod startup time

C To reduce network traffic

D To make secrets visible in logs

Encrypting secrets at rest protects sensitive data if someone accesses the storage without permission.

Explain how Kubernetes encrypts secrets at rest and which components are involved.

Think about where secrets live and who handles encryption.

Describe the steps to enable secrets encryption at rest in a Kubernetes cluster.

Focus on configuration and API server setup.