Config - Secrets

Question 1

se

Why would it not be smart to move important configuration details like passwords into a configMap?

Answer 1

Because the data is stored in plain text format

Question 2

What are Secrets used for? And why?

Answer 2

For storing sensitive information like passwords or keys.

Stored in an encoded format

Question 3

How are the steps for working with secrets?

Answer 3

1. Create Secret
2. Inject into Pod

Question 4

How can a secret be created?

Answer 4

Imperatively, without yaml file

Declaratively with yaml file

Question 5

How does one create imperatively a secret?

Answer 5

‘kubectl create secret generic < secret-name> –from-literal=< key>=< value>’

Key value pairs directly in CI

Or from a file
‘kubectl create secret generic –from-file=< path-tofile>’

Question 6

How does a yaml for a secret look like?

Answer 6

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
data:
  DB_HOST: bxWLSD(
	DB_User: ASJDEL(
	DB_password: POMSR%

Important: Data needs to be specified in an encoded format

Question 7

How do you encode text on linux in the cl?

Answer 7

echo -n 'mysql'  | base64

echso -n root | base 64

Question 8

How can you view the for a created secret used values?

Answer 8

kubectl get descret app-secret -o yaml

Question 9

How do you decode base64 encoded values in Linux?

Answer 9

echo -n ‘bXlzcWw=’ | base64 –decode

Question 10

How do you inject Secrets into pods?

Answer 10

in Yaml

spec:
...
   envFrom:
	   - secretRef:
	    name: app-secret

Question 11

What are ways for a secret to be injected into pods?

Answer 11

envFrom: 
  - secretRef:
    name: app-secret

env:
- name: DB_Password
  valueFrom: 
	    secretKeyRef:
			  name: app-secret
				key: DB_password
				
---
	
	volumes:
	  - name: app-secret-volume
	    secret: 
			   secretName: app-secret

Question 12

What is important about secrets?

Answer 12

• secrets are not encrypted, only encoded
• secrets are not encrypted in etcd by default
• anyone able to create pods/deployments in the same namespace can access the secrets
• consider third-party secrets store providers

Question 13

How do you install the etcd client in order to encrypt data at rest

Answer 13

‘apt-get install etcd-client’