CKA ConfigMaps and Secrets 2 — Questions and Answers
Question 1: What is the default type of a Kubernetes Secret when created with 'kubectl create secret generic'?
- Opaque (Correct answer)
- kubernetes.io/tls
- kubernetes.io/dockerconfigjson
- kubernetes.io/service-account-token
Correct answer: Opaque
The 'generic' subcommand creates an Opaque Secret, which is the most common type used for arbitrary user-defined key-value data.
Question 2: How is Secret data stored in etcd by default in a Kubernetes cluster?
- Base64-encoded but not encrypted (Correct answer)
- AES-256 encrypted
- Plain text
- Hashed with SHA-256
Correct answer: Base64-encoded but not encrypted
By default, Kubernetes stores Secrets as base64-encoded values in etcd without encryption at rest; encryption at rest must be explicitly configured.
Question 3: Which kubectl command creates a Secret of type 'kubernetes.io/dockerconfigjson' for pulling images from a private registry?
- kubectl create secret docker-registry (Correct answer)
- kubectl create secret generic --type=docker
- kubectl create secret tls --registry
- kubectl create secret registry-auth
Correct answer: kubectl create secret docker-registry
The 'docker-registry' subcommand of kubectl create secret automatically sets the correct type and formats the .dockerconfigjson key.
Question 4: What Secret type should be used to store a TLS private key and certificate pair?
- kubernetes.io/tls (Correct answer)
- kubernetes.io/ssl
- Opaque
- kubernetes.io/cert
Correct answer: kubernetes.io/tls
The kubernetes.io/tls type enforces that the Secret contains tls.crt and tls.key fields, which are used by Ingress and other TLS-aware resources.
Question 5: What is the purpose of the 'stringData' field in a Secret manifest?
- It allows providing plain text values that Kubernetes will automatically base64-encode (Correct answer)
- It stores decoded values that bypass base64 encoding at runtime
- It accepts only ASCII strings and rejects binary data
- It is an alias for 'data' with no functional difference
Correct answer: It allows providing plain text values that Kubernetes will automatically base64-encode
The stringData field is a write-only convenience field that accepts plain strings; Kubernetes base64-encodes them and merges the result into the data field on save.
Question 6: What happens to a Pod if it references a Secret that does not exist in the same namespace?
- The Pod remains in Pending state and fails to start (Correct answer)
- The Pod starts but the environment variable is set to an empty string
- The Pod starts and the missing Secret key is skipped
- Kubernetes automatically creates an empty Secret with that name
Correct answer: The Pod remains in Pending state and fails to start
If a referenced Secret is missing, the container cannot be started and the Pod stays in Pending with an error event indicating the missing resource.
Question 7: How do you use a Secret to pull images from a private container registry in a Pod spec?
- Specify the Secret name under the 'imagePullSecrets' field in the Pod spec (Correct answer)
- Mount the Secret as a volume at /root/.docker/config.json
- Reference the Secret using envFrom with type=dockerconfigjson
- Annotate the Pod with 'kubernetes.io/registry-secret: <name>'
Correct answer: Specify the Secret name under the 'imagePullSecrets' field in the Pod spec
The imagePullSecrets field in a Pod spec (or ServiceAccount) tells the kubelet which Secret to use when authenticating to a private image registry.
CKA ConfigMaps and Secrets 2
What is the default type of a Kubernetes Secret when created with 'kubectl create secret generic'?