English
Menu

Cloud and Container Basics

A database password is stored in a Kubernetes Secret. Which of the following correctly describes a Secret?

  1. AValues put in a Secret are automatically encrypted with strong cryptography, so no one in the cluster who reads them can learn the original password
  2. BSecret values cannot be referenced from containers, so the password has to be written in a configuration file inside the image
  3. CBy default the values are merely represented in Base64, which is not encryption, so restricting who can read them and encryption at rest are used as well
Show answer and explanation

Answer: C. By default the values are merely represented in Base64, which is not encryption, so restricting who can read them and encryption at rest are used as well

A Secret is a resource for managing confidential values such as passwords and API keys separately from images and Pod definitions and passing them to containers as environment variables or files. However, the values written in a manifest are only represented in Base64, which anyone can decode. Also, by default, they are stored unencrypted in etcd, where the cluster's data is kept. Measures such as limiting with RBAC who can read Secrets and enabling encryption at rest for etcd are therefore used together.

  • A. Base64 is an encoding, not encryption. Anyone with permission to read the value can decode it.
  • B. Secrets can be passed to containers as environment variables or files. A password written in the image becomes known to anyone who can pull the image.
  • C. Correct. Base64 is not encryption, so combine it with access restrictions and encryption at rest.
Practice this topic Back to topic

Books on Cloud and Container Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Cloud and Container Basics questions

  1. A web application cannot handle requests for about 60 seconds after starting, while it loads its cache, and returns 503 from /ready during that time. Which of the following correctly describes the effect of adding the settings above to the Pod's container?
  2. In a web application on Kubernetes, the check performed by the liveness probe was made to include whether the application can connect to the database it depends on. Which of the following is the most likely problem with this setting?
  3. A Kubernetes HorizontalPodAutoscaler has a target CPU utilization of 70% and a range of 1 to 10 Pods. Currently the average CPU utilization of 5 Pods is 30%. When the required number of Pods is computed as ⌈current number × current utilization ÷ target utilization⌉ (⌈ ⌉ means rounding up), which of the following is the required number of Pods?
  4. In a Deployment whose Pod containers have the settings above, four Pods are running, each using 400m (0.4 cores) of CPU. The HorizontalPodAutoscaler's target CPU utilization is 60%, and the required number of Pods is computed as ⌈current number × current utilization ÷ target utilization⌉. Which of the following is the required number of Pods?
  5. In Kubernetes, which of the following correctly describes the resource requests and limits set for a container?