Quiz Module 5 - Configuration and Secrets

Instructions

This quiz contains 30 multiple-choice questions.

---

Question 1

What is a ConfigMap?

1. A Kubernetes object that stores non-sensitive configuration data

2. A type of volume

3. A network service

See explanation

Correct answer: A Kubernetes object that stores non-sensitive configuration data

Explanation: ConfigMaps allow separating configuration from application code.

---

Question 2

What is a Secret in Kubernetes?

1. A type of ConfigMap

2. A Kubernetes object that stores sensitive data like passwords, tokens, or keys

3. A type of volume

4. A network service

See explanation

Correct answer: A Kubernetes object that stores sensitive data like passwords, tokens, or keys

Explanation: Secrets are similar to ConfigMaps but are designed to store sensitive data. They are stored in base64 (no encryption by default).

---

Question 3

How to create a ConfigMap from a file?

1. kubectl create configmap --from-file

2. kubectl create configmap [name] --from-file=[file]

3. kubectl apply configmap --file

4. kubectl new configmap --file

See explanation

Correct answer: kubectl create configmap [name] --from-file=[file]

Explanation: The --from-file command allows creating a ConfigMap from a file, where the key will be the file name and the value will be the file content.

---

Question 4

What is the maximum size of an entry in a ConfigMap?

1. 100 KiB

2. 1 MiB

3. 10 MiB

4. 100 MiB

See explanation

Correct answer: 1 MiB

Explanation: Each entry in a ConfigMap or Secret is limited to 1 MiB. For larger data, use volumes.

---

Question 5

How to inject a ConfigMap as an environment variable in a Pod?

1. env: configMapRef

2. envFrom: - configMapRef: name: [configmap-name]

3. volumeMounts: configMap

4. env: valueFrom: configMap

See explanation

Correct answer: envFrom: - configMapRef: name: [configmap-name]

Explanation: envFrom allows injecting all keys from a ConfigMap as environment variables. For a specific key, use env with valueFrom.configMapKeyRef.

---

Question 6

How to mount a ConfigMap as a volume in a Pod?

1. env: volume: configMap

2. volumes: - name: config configMap: name: [configmap-name]

3. volumeMounts: configMap

4. mount: configMap

See explanation

Correct answer: volumes: - name: config configMap: name: [configmap-name]

Explanation: To mount a ConfigMap as a volume, define it in the Pod's volumes section, then use volumeMounts to mount it in the container.

---

Question 7

What is the main difference between a ConfigMap and a Secret?

1. No difference

2. Secrets are designed for sensitive data and are stored in base64, ConfigMaps for non-sensitive data

3. ConfigMaps are more secure

4. Secrets cannot be mounted as volumes

See explanation

Correct answer: Secrets are designed for sensitive data and are stored in base64, ConfigMaps for non-sensitive data

Explanation: Secrets are intended for sensitive data but are not encrypted by default (just encoded in base64). ConfigMaps are for non-sensitive data.

---

Question 8

How to create a Secret from literals?

1. kubectl create secret --from-literal

2. kubectl create secret generic [name] --from-literal=[key]=[value]

3. kubectl apply secret --literal

4. kubectl new secret --literal

See explanation

Correct answer: kubectl create secret generic [name] --from-literal=[key]=[value]

Explanation: --from-literal allows creating a Secret directly from key-value pairs on the command line.

---

Question 9

What is the best practice for managing secrets in production?

1. Commit them in Git

2. Use external secret management tools (Vault, AWS Secrets Manager) with External Secrets Operator

3. Store them in plain text in YAML

4. Share them via email

See explanation

Correct answer: Use external secret management tools (Vault, AWS Secrets Manager) with External Secrets Operator

Explanation: Secrets should never be committed to Git. Use external tools like Vault or cloud services with External Secrets Operator for secure management.

---

Question 10

What is encryption at rest for Secrets?

1. Automatic encryption of Secrets in etcd

2. A feature that encrypts Secrets in etcd using an EncryptionConfig

3. Storing Secrets in base64

4. Volume encryption

See explanation

Correct answer: A feature that encrypts Secrets in etcd using an EncryptionConfig

Explanation: Encryption at rest allows encrypting Secrets in etcd by configuring an EncryptionConfig with encryption providers (AES, KMS, etc.).

---

Question 11

Which command allows viewing the content of a Secret (decoded)?

1. kubectl get secret [name] -o yaml

2. kubectl get secret [name] -o jsonpath='{.data.[key]}' | base64 -d

3. kubectl describe secret [name]

4. kubectl show secret [name]

See explanation

Correct answer: kubectl get secret [name] -o jsonpath='{.data.[key]}' | base64 -d

Explanation: Secrets are stored in base64. To view the decoded content, use jsonpath to extract the value and base64 -d to decode.

---

Question 12

What is External Secrets Operator?

1. A type of Secret

2. A Kubernetes operator that synchronizes secrets from external systems (AWS Secrets Manager, Vault, etc.) to Kubernetes

3. A CNI plugin

4. A type of ConfigMap

See explanation

Correct answer: A Kubernetes operator that synchronizes secrets from external systems (AWS Secrets Manager, Vault, etc.) to Kubernetes

Explanation: External Secrets Operator allows managing secrets centrally in external systems and automatically synchronizing them to Kubernetes.

---

Question 13

What is the recommended method to inject a Secret into a Pod?

1. Hardcode in the code

2. Use envFrom with secretRef or env with valueFrom.secretKeyRef

3. Copy them manually

4. Pass them as arguments

See explanation

Correct answer: Use envFrom with secretRef or env with valueFrom.secretKeyRef

Explanation: Secrets should be injected via envFrom (all keys) or env with valueFrom.secretKeyRef (a specific key), never hardcoded.

---

Question 14

What is the difference between env and envFrom?

1. No difference

2. env allows injecting individual variables, envFrom injects all keys from a ConfigMap/Secret

3. env is for Secrets, envFrom for ConfigMaps

4. envFrom is deprecated

See explanation

Correct answer: env allows injecting individual variables, envFrom injects all keys from a ConfigMap/Secret

Explanation: env allows precise control over each variable, while envFrom automatically injects all keys as environment variables.

---

Question 15

What is the best practice for permissions of a Secret volume?

1. 0777 (read, write, execute for all)

2. 0400 (read-only for the owner)

3. 0755 (read and execute for all)

4. 0600 (read and write for the owner)

See explanation

Correct answer: 0400 (read-only for the owner)

Explanation: Secret volumes should be mounted as read-only (readOnly: true) with restrictive permissions (defaultMode: 0400) for security.

---

Question 16

What is an immutable ConfigMap?

1. A ConfigMap that cannot be read

2. A ConfigMap that cannot be modified after creation, improving performance and security

3. A deprecated ConfigMap

4. A ConfigMap that cannot be deleted

See explanation

Correct answer: A ConfigMap that cannot be modified after creation, improving performance and security

Explanation: Immutable ConfigMaps (immutable: true) cannot be modified, reducing load on the API Server and improving security.

---

Question 17

How to update a ConfigMap used by a running Pod?

1. The ConfigMap updates automatically

2. If mounted as a volume, restart the Pod. If injected as env, recreate the Pod

3. The Pod updates automatically

4. Impossible to update

See explanation

Correct answer: If mounted as a volume, restart the Pod. If injected as env, recreate the Pod

Explanation: ConfigMaps mounted as volumes are updated periodically, but injected environment variables do not change without recreating the Pod.

---

Question 18

What is the command to create a Secret from a file?

1. kubectl create secret --from-file

2. kubectl create secret generic [name] --from-file=[key]=[file]

3. kubectl apply secret --file

4. kubectl new secret --file

See explanation

Correct answer: kubectl create secret generic [name] --from-file=[key]=[file]

Explanation: --from-file allows creating a Secret from a file, where you can specify the key and the source file.

---

Question 19

What is secret rotation?

1. Deleting secrets

2. The process of periodically replacing secrets with new values for security

3. Copying secrets

4. Encrypting secrets

See explanation

Correct answer: The process of periodically replacing secrets with new values for security

Explanation: Secret rotation is a security best practice that involves regularly changing passwords, tokens, and keys to limit the impact of a compromise.

---

Question 20

What is the difference between an Opaque Secret and a TLS Secret?

1. No difference

2. Opaque is for arbitrary data, TLS is specifically for TLS certificates

3. TLS is for arbitrary data

4. Opaque is deprecated

See explanation

Correct answer: Opaque is for arbitrary data, TLS is specifically for TLS certificates

Explanation: TLS Secrets have specific keys (tls.crt, tls.key) and are used by tools like cert-manager for SSL/TLS certificates.

---

Question 21

How to organize ConfigMaps by environment?

1. Use a single ConfigMap for all environments

2. Create separate ConfigMaps per environment (dev, staging, prod) with different names

3. Use labels only

4. Use namespaces only

See explanation

Correct answer: Create separate ConfigMaps per environment (dev, staging, prod) with different names

Explanation: The best practice is to create distinct ConfigMaps for each environment, allowing clear management and avoiding configuration errors.

---

Question 22

What is the total size limit of a ConfigMap or Secret?

1. 1 MiB

2. Limited by etcd (generally 1.5 MiB per object)

3. 10 MiB

4. 100 MiB

See explanation

Correct answer: Limited by etcd (generally 1.5 MiB per object)

Explanation: Although each entry is limited to 1 MiB, the total size of a ConfigMap or Secret is limited by etcd, generally around 1.5 MiB.

---

Question 23

What is a Secret volume type?

1. A type of Secret

2. A volume that mounts Secret data as files in a Pod

3. An encrypted volume

4. A type of ConfigMap

See explanation

Correct answer: A volume that mounts Secret data as files in a Pod

Explanation: Secrets can be mounted as volumes, where each key becomes a file with the decoded value as content.

---

Question 24

What is the best practice for secrets in YAML?

1. Put them in plain text in YAML

2. Never put secrets in plain text, use references (secretKeyRef) or external tools

3. Comment them in YAML

4. Put them in base64 in YAML

See explanation

Correct answer: Never put secrets in plain text, use references (secretKeyRef) or external tools

Explanation: Secrets should never be in plain text in YAML, even in base64. Use references or secret management tools.

---

Question 25

How to use a ConfigMap in a Deployment?

1. Directly in the Deployment

2. In the Deployment's Pod template, via env, envFrom, or volumes

3. In annotations

4. In labels

See explanation

Correct answer: In the Deployment's Pod template, via env, envFrom, or volumes

Explanation: ConfigMaps are referenced in the Pod template (spec.template.spec) of a Deployment, via env/envFrom for environment variables or volumes for files.

---

Question 26

What is a Service Account in the context of Secrets?

1. A type of Secret

2. An identity for Pods that can be associated with Secrets for API Server access

3. A user account

4. A type of ConfigMap

See explanation

Correct answer: An identity for Pods that can be associated with Secrets for API Server access

Explanation: Service Accounts can have imagePullSecrets for accessing private registries, but are not directly related to application Secrets.

---

Question 27

What is the command to delete a ConfigMap?

1. kubectl remove configmap [name]

2. kubectl delete configmap [name]

3. kubectl rm configmap [name]

4. kubectl drop configmap [name]

See explanation

Correct answer: kubectl delete configmap [name]

Explanation: kubectl delete is the standard command to delete any Kubernetes resource, including ConfigMaps.

---

Question 28

What is a docker-registry Secret?

1. A Secret for Docker

2. A Secret that stores credentials for accessing a private Docker registry

3. A type of ConfigMap

4. A deprecated Secret

See explanation

Correct answer: A Secret that stores credentials for accessing a private Docker registry

Explanation: docker-registry Secrets are used as imagePullSecrets to allow Pods to pull images from private registries.

---

Question 29

What is the best practice for versioning ConfigMaps?

1. Do not version

2. Use labels with version numbers and create new ConfigMaps for each version

3. Use annotations only

4. Modify the same ConfigMap

See explanation

Correct answer: Use labels with version numbers and create new ConfigMaps for each version

Explanation: Versioning ConfigMaps with labels allows tracking changes and facilitates rollbacks by referencing different versions.

---

Question 30

What is the difference between valueFrom.configMapKeyRef and valueFrom.secretKeyRef?

1. No difference

2. configMapKeyRef references a key from a ConfigMap, secretKeyRef references a key from a Secret

3. secretKeyRef is for ConfigMaps

4. configMapKeyRef is deprecated

See explanation

Correct answer: configMapKeyRef references a key from a ConfigMap, secretKeyRef references a key from a Secret

Explanation: These two references work the same way but point to different resource types: ConfigMap for non-sensitive data, Secret for sensitive data.

---

Quiz Result

Congratulations on completing the Module 5 quiz!

Score:

• 25-30 correct answers: Excellent! You master configuration and secrets.
• 20-24 correct answers: Very good! Review the concepts where you had difficulties.
• 15-19 correct answers: Good! Review the chapters on ConfigMaps and Secrets.
• Less than 15: Recommended to review the module before continuing.

---

Quiz created on: December 2024