Study. uk . com
  1. Home
  2. All questions
  3. Question 601

CKA study material · question 601 of 1000

A security review asks how Secrets could be read in a cluster with no special hardening. Which two statements are accurate? Choose two.

  1. Secret values are stored unencrypted in etcd unless encryption at rest is enabled
  2. Secret values are encrypted with the cluster CA key by default
  3. Anyone able to create a Pod in a namespace can read any Secret in it
  4. Only the kubelet on the Pod's node can decrypt a Secret
Show the answer

Answer: A. Secret values are stored unencrypted in etcd unless encryption at rest is enabled
C. Anyone able to create a Pod in a namespace can read any Secret in it

Secrets are stored unencrypted by default, and Pod-creation rights in a namespace are enough to mount and read any Secret there — including indirect rights such as creating a Deployment.

Source: Secrets (Kubernetes) — Secrets (overview)

Challenge yourself on this topic → Study as cards