CKAD Configuration and Secrets 1 — Questions and Answers
Question 1: How do you create a ConfigMap named 'app-config' from a literal key-value pair 'APP_ENV=production'?
- kubectl create configmap app-config --from-literal=APP_ENV=production (Correct answer)
- kubectl apply configmap app-config --value=APP_ENV=production
- kubectl set configmap app-config APP_ENV=production
- kubectl create configmap app-config --key=APP_ENV --value=production
Correct answer: kubectl create configmap app-config --from-literal=APP_ENV=production
The '--from-literal=key=value' flag on 'kubectl create configmap' creates a ConfigMap from inline key-value pairs.
Question 2: Which Pod spec field injects all keys of a ConfigMap as environment variables?
- env.valueFrom.configMapKeyRef
- envFrom.configMapRef (Correct answer)
- volumeMounts.configMap
- env.configMapRef
Correct answer: envFrom.configMapRef
'envFrom' with 'configMapRef' injects every key in the ConfigMap as a separate environment variable in the container.
Question 3: What is the default encoding used for Secret values in Kubernetes?
- UTF-8 plaintext
- AES-256 encrypted
- Base64 encoded (Correct answer)
- SHA-256 hashed
Correct answer: Base64 encoded
Kubernetes stores Secret values as base64-encoded strings; this is encoding, not encryption, and secrets should be protected by RBAC.
Question 4: Which command creates a Secret named 'db-secret' with username and password from literal values?
- kubectl create secret generic db-secret --from-literal=username=admin --from-literal=password=pass123 (Correct answer)
- kubectl create secret tls db-secret --username=admin --password=pass123
- kubectl apply secret db-secret --data username=admin password=pass123
- kubectl set secret db-secret username=admin password=pass123
Correct answer: kubectl create secret generic db-secret --from-literal=username=admin --from-literal=password=pass123
'kubectl create secret generic' with multiple '--from-literal' flags creates an opaque Secret with multiple keys.
Question 5: How do you mount a Secret as a volume so each key becomes a file in the pod?
- Use 'envFrom.secretRef' in the container spec
- Use 'volumes.secret.secretName' and mount it with 'volumeMounts' (Correct answer)
- Use 'env.valueFrom.secretKeyRef' for every key
- Use 'secretMount' in the container spec
Correct answer: Use 'volumes.secret.secretName' and mount it with 'volumeMounts'
Defining a secret volume under 'volumes' and referencing it in 'volumeMounts' makes each Secret key available as a file.
Question 6: What type of Secret should you use to store Docker registry credentials for image pulling?
- generic
- tls
- docker-registry (Correct answer)
- opaque
Correct answer: docker-registry
The 'kubernetes.io/dockerconfigjson' Secret type (created via '--type=docker-registry') stores registry credentials used by imagePullSecrets.
CKAD Configuration and Secrets 1
How do you create a ConfigMap named 'app-config' from a literal key-value pair 'APP_ENV=production'?