CKA ConfigMaps and Secrets 2

Question 1

What is the default type of a Kubernetes Secret when created with 'kubectl create secret generic'?

Accepted Answer

Opaque

Answer

The 'generic' subcommand creates an Opaque Secret, which is the most common type used for arbitrary user-defined key-value data.

Question 2

How is Secret data stored in etcd by default in a Kubernetes cluster?

Accepted Answer

Base64-encoded but not encrypted

Answer

By default, Kubernetes stores Secrets as base64-encoded values in etcd without encryption at rest; encryption at rest must be explicitly configured.

Question 3

Which kubectl command creates a Secret of type 'kubernetes.io/dockerconfigjson' for pulling images from a private registry?

Accepted Answer

kubectl create secret docker-registry

Answer

The 'docker-registry' subcommand of kubectl create secret automatically sets the correct type and formats the .dockerconfigjson key.

Question 4

What Secret type should be used to store a TLS private key and certificate pair?

Accepted Answer

kubernetes.io/tls

Answer

The kubernetes.io/tls type enforces that the Secret contains tls.crt and tls.key fields, which are used by Ingress and other TLS-aware resources.

Question 5

What is the purpose of the 'stringData' field in a Secret manifest?

Accepted Answer

It allows providing plain text values that Kubernetes will automatically base64-encode

Answer

The stringData field is a write-only convenience field that accepts plain strings; Kubernetes base64-encodes them and merges the result into the data field on save.

(CKA) Certified Kubernetes Administrator Practice Test

(CKA) Certified Kubernetes Administrator Practice Test

CKA ConfigMaps and Secrets 2