Secrets encryption at rest in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption of Kubernetes secrets at rest by specifying the encryption provider.

Kubernetes

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - [1]:
      keys:
      - name: key1
        secret: <base64-encoded-secret>

Drag options to blanks, or click blank then click option'

Aaescbc

Bplaintext

Cidentity

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'plaintext' or 'identity' which do not encrypt secrets.

Leaving the provider field empty.

The aescbc provider enables AES-CBC encryption for secrets at rest in Kubernetes. Other options like plaintext or identity do not encrypt data.

2fill in blank

medium

Complete the command to restart the Kubernetes API server to apply the encryption configuration.

Kubernetes

kubectl -n kube-system delete pod -l component=[1]

Drag options to blanks, or click blank then click option'

Akube-controller-manager

Bkube-scheduler

Ckube-apiserver

Detcd

Attempts:

3 left

💡 Hint

Common Mistakes

Restarting the etcd pod instead of the API server.

Using the controller-manager or scheduler labels.

The Kubernetes API server pod must be restarted to apply the encryption configuration. The label component=kube-apiserver targets the API server pods.

3fill in blank

hard

Fix the error in the encryption configuration by choosing the correct key format for the secret.

Kubernetes

providers:
- aescbc:
    keys:
    - name: key1
      secret: [1]

Drag options to blanks, or click blank then click option'

Amy-secret-key

Bbase64encodedkey

C1234567890abcdef

DYWJjMTIzIT8kKiYoKSctPUB+

Attempts:

3 left

💡 Hint

Common Mistakes

Using plain text keys instead of base64 encoded strings.

Using incomplete or invalid base64 strings.

The secret key must be base64 encoded. Option D is a valid base64 string, while others are plain text or invalid formats.

4fill in blank

hard

Fill both blanks to complete the command that checks if secrets are encrypted in etcd by querying etcd directly.

Kubernetes

ETCDCTL_API=3 etcdctl --endpoints=[1] get /registry/secrets --prefix --keys-only | grep [2]

Drag options to blanks, or click blank then click option'

Ahttps://127.0.0.1:2379

Bdefault

Ckube-system

Dsecrets

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong etcd endpoint URL.

Filtering with incorrect keywords like 'default' or 'kube-system'.

The etcd endpoint is usually at https://127.0.0.1:2379. To filter secret keys, grep for secrets in the keys output.

5fill in blank

hard

Fill all three blanks to create a Kubernetes manifest snippet that enables encryption at rest with the 'aescbc' provider and a base64 key.

Kubernetes

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - [1]:
      keys:
      - name: [2]
        secret: [3]

Drag options to blanks, or click blank then click option'

Aaescbc

Bkey1

CYWJjMTIzIT8kKiYoKSctPUB+

Didentity

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'identity' as provider which disables encryption.

Using plain text instead of base64 for the secret.

This manifest enables AES-CBC encryption for secrets using a key named 'key1' with a base64 encoded secret key.