CKA Application Lifecycle 3 — Questions and Answers
Question 1: You have a pod that must read a database password at startup. Which Kubernetes object is most appropriate for storing this credential?
- ConfigMap
- Secret (Correct answer)
- PersistentVolume
- ServiceAccount
Correct answer: Secret
Secrets are designed for sensitive data like passwords and are base64-encoded at rest; ConfigMaps are for non-sensitive configuration data.
Question 2: How do you inject all key-value pairs from a ConfigMap as environment variables into a container?
- Use `env.valueFrom.configMapKeyRef` for each key
- Use `envFrom.configMapRef` in the container spec (Correct answer)
- Mount the ConfigMap as a volume and read the file
- Set `configMap.inject: true` in the pod spec
Correct answer: Use `envFrom.configMapRef` in the container spec
`envFrom.configMapRef` injects all keys from a ConfigMap as environment variables in one declaration, avoiding the need to reference each key individually.
Question 3: A pod mounts a Secret as a volume. The Secret is updated in the cluster. When will the pod see the updated values?
- Immediately upon Secret update
- After the pod is restarted
- Within the kubelet sync period (typically up to 1 minute) (Correct answer)
- Never — secrets are immutable once mounted
Correct answer: Within the kubelet sync period (typically up to 1 minute)
Kubelet periodically syncs mounted Secrets and ConfigMaps; changes propagate to the mounted volume within the kubelet's cache TTL, typically up to ~1 minute.
Question 4: What happens to environment variables in a running pod when a referenced ConfigMap is updated?
- They update within the kubelet sync period
- They update only after the pod is restarted (Correct answer)
- They are updated immediately via the API server
- The pod is automatically restarted
Correct answer: They update only after the pod is restarted
Environment variables are set at container startup and do not change during the container's lifetime; the pod must be restarted to pick up ConfigMap changes injected as env vars.
Question 5: You want to create a ConfigMap from a directory of config files. Which command accomplishes this?
- kubectl create configmap myconfig --from-file=./config-dir/ (Correct answer)
- kubectl apply configmap myconfig --directory=./config-dir/
- kubectl create configmap myconfig --from-literal=./config-dir/
- kubectl generate configmap myconfig --path=./config-dir/
Correct answer: kubectl create configmap myconfig --from-file=./config-dir/
`kubectl create configmap --from-file=<dir>` creates a ConfigMap where each file in the directory becomes a key (filename) with its contents as the value.
Question 6: A Secret of type `kubernetes.io/dockerconfigjson` is used for which purpose?
- Storing TLS certificates for ingress
- Authenticating to a private container registry to pull images (Correct answer)
- Providing OAuth tokens for service accounts
- Encrypting etcd data at rest
Correct answer: Authenticating to a private container registry to pull images
The `kubernetes.io/dockerconfigjson` Secret type stores Docker registry credentials, referenced via `imagePullSecrets` in a pod spec to authenticate image pulls.
Question 7: Which field in a pod spec references a Secret to authenticate image pulls from a private registry?
- spec.registryCredentials
- spec.imagePullSecrets (Correct answer)
- spec.containers.env.secretRef
- spec.serviceAccount.imagePullPolicy
Correct answer: spec.imagePullSecrets
`spec.imagePullSecrets` accepts a list of Secret names of type `kubernetes.io/dockerconfigjson`, which kubelet uses when pulling container images from private registries.
CKA Application Lifecycle 3
You have a pod that must read a database password at startup.
Which Kubernetes object is most appropriate for storing this credential?