Credential Overview Flashcards

Which Kubernetes resource type stores TLS certificates and private keys used by Ingress controllers?

Answer: Secret of type kubernetes.io/tls

A Secret of type kubernetes.io/tls stores a TLS certificate (tls.crt) and private key (tls.pem) for use by Ingress controllers.

What is the default expiration duration for a Kubernetes ServiceAccount token created via the TokenRequest API?

Answer: 1 hour

The default expiration for tokens issued by the TokenRequest API is 1 hour, though it can be configured.

Which field in a kubeconfig file specifies the cluster's API server address?

Answer: server

The 'server' field under a cluster entry in kubeconfig specifies the URL of the Kubernetes API server.

How does Kubernetes authenticate a request when a client presents an X.509 certificate?

Answer: It validates the certificate against the cluster CA and uses the CN as the username

Kubernetes validates the client certificate against the cluster CA and extracts the Common Name (CN) as the username and Organization (O) as groups.

Which command creates a CertificateSigningRequest (CSR) resource in Kubernetes?

Answer: kubectl apply -f csr.yaml

You create a CertificateSigningRequest by applying a YAML manifest with kind: CertificateSigningRequest using kubectl apply.

What happens to a projected ServiceAccount token when the pod it is mounted in is deleted?

Answer: The token continues to be valid until its expiration time

Projected tokens remain cryptographically valid until their expiry time; Kubernetes does not maintain a revocation list.

Which kubeconfig context field links a user credential to a cluster?

Answer: context

A context in kubeconfig binds a cluster, a user credential, and optionally a namespace together under a named entry.