Discuss Linux Foundation CKS Exam Topic 1 Question 17

Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value

for e.g:-

AETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert='ca.crt' --cert='server.crt' --key='server.key'
Output

Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.

Suggested Answer: A

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Rebecka 1 year ago

Yeah, but if you set up encryption, it should be fine, right?

Estrella 1 year ago

I thought they were secure at rest with the right config?

Ettie 1 year ago

Wait, you can just use etcdctl to get secrets? That's a bit concerning...

Brandee 1 year ago

Totally agree, encryption is a must for sensitive data!

Cory 1 year ago

That's true, etcd secrets aren't secure by default.

Osvaldo 1 year ago

I definitely remember that secrets need to be encrypted at rest, but I’m uncertain if I need to specify the provider in the manifest or just the encryption type.

Gwen 1 year ago

I feel like I’ve seen the etcdctl command before, but I’m a bit confused about the flags for certs and keys.

Janessa 1 year ago

I remember studying how etcd stores secrets, but I'm not entirely sure how to implement the encryption configuration correctly.

Sina 1 year ago

I think we practiced a similar question about securing secrets with AES-CBC, but I can't recall the exact steps for creating the manifest.

Tamie 1 year ago

I've got a good feeling about this one. Based on my experience with PP/DS, I think option D, using a planning group, is the way to go. That should allow us to target the specific resources we need to plan for.

Marshall 1 year ago

Alright, I think I've got it. The key is understanding how the expression works and applying the filters correctly. I'll walk through the logic step-by-step to make sure I've got the right approach.

Lucy 1 year ago

Ah, this is a tricky one. I remember learning about ACK's scheduling capabilities, but I'm drawing a blank on the specifics. I'll have to review my notes and try to eliminate the options that don't sound right.

Lewis 1 year ago

I remember practicing a similar question, and it involved setting the trunk mode, but that doesn't sound like it applies to untagged traffic.

Linux Foundation CKS Exam - Topic 1 Question 17 Discussion