MENU
Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value
for e.g:-
ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" --cert="server.crt" --key="server.key"
Output
Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
38 comments · newest first
SH
Shoshana
11 months ago
Definitely need to set up that encryption config ASAP!
KI
Kiley
11 months ago
Surprised to hear that! I thought encryption was a given.
QU
Quentin
12 months ago
Yeah, I've used etcdctl before, it's pretty straightforward.
JA
Jani
12 months ago
I thought they were supposed to be secure at rest?
PE
Pearly
1 year ago
That's true, etcd secrets can be accessed like that.
GL
Glory
1 year ago
I feel confident about using etcdctl, but I need to double-check the steps for setting up the encryption configuration in the manifest.
AU
Audra
1 year ago
The command to check if secrets are encrypted seems familiar, but I might mix up the paths for different namespaces.
AL
Aleisha
1 year ago
I think we did a similar question in class about securing secrets, but I can't recall the exact syntax for the AES-CBC provider.
BR
Broderick
1 year ago
I remember practicing with etcdctl commands, but I'm not entirely sure how to create the manifest for the encryption configuration.
BE
Bernardine
1 year ago
This seems like a good opportunity to demonstrate my understanding of etcd security and encryption. I'll start by running the etcdctl command to confirm the secret is stored in plaintext. Then I'll carefully craft the encryption configuration manifest to ensure all secrets are properly encrypted at rest.
TI
Tiara
1 year ago
Okay, I think I've got this. First, I'll use etcdctl to verify the secret value is not encrypted. Then I'll create a manifest with the encryption configuration to secure the secrets using AES-CBC. Shouldn't be too difficult as long as I get the details right in the manifest.
AN
Angella
1 year ago
This question seems straightforward. I'll start by using the etcdctl command to check the secret value, as shown in the example. Then I'll need to create a manifest to configure encryption for the secrets using the AES-CBC provider and identity.
JO
Josephine
1 year ago
Hmm, I'm a bit confused about the encryption configuration part. I'll need to review the details on how to set that up properly in the manifest. The etcdctl command looks simple enough, but I want to make sure I understand the encryption requirements fully.
LA
Lai
1 year ago
This is a tricky one. The details about the insurer acting as an agent and making the actual claim payments from Flair's account don't seem to match up perfectly with any of the answer choices. I'm going to have to think this through step-by-step to figure out the right approach.
RY
Ryan
1 year ago
I'm a bit confused on the rate of return. If the rate is low, the value goes up, right? I just can't seem to remember the exact calculation.
TH
Theron
1 year ago
I'm a little confused by the terminology here. What's the difference between an Access Username and an Access Key ID? I'll have to review my notes to make sure I understand the concepts.
LO
Louisa
1 year ago
Okay, let's see. The question mentions customer service, so I'm guessing the Case entity would be a good choice. And maybe something like Goal or Social activity could also be used. I'll select those and see how it goes.
PH
Phil
1 year ago
This is a good test of our understanding of information security principles. I'll methodically go through each option and consider how they align with managing information that is no longer needed.
RE
Reed
1 year ago
Well, at least they're not asking us to do a barrel roll in the middle of the exam. Although, that would probably be more fun than trying to secure those etcd secrets.
RI
Rikki
1 year ago
Haha, that would definitely make the exam more interesting.
TO
Tony
1 year ago
Yeah, let's hope for the best during the exam.
PA
Paulina
1 year ago
I hope the encryption configuration helps in securing the secrets properly.
DE
Derick
1 year ago
I wish they would ask us to do a barrel roll instead!
FL
Florinda
1 year ago
I agree, securing etcd secrets can be quite challenging.
RU
Rupert
1 year ago
I agree, securing etcd secrets can be quite challenging.
BE
Beata
2 years ago
Ah, the joys of working with sensitive data. Gotta love how they give you the exact command to reveal the secrets. It's like they want us to become master hackers or something!
EM
Emmett
1 year ago
User 2
ST
Stevie
1 year ago
User 1
AN
Antonette
2 years ago
Hmm, I'm not sure I'd want to be running that etcdctl command on my production cluster. Sounds like a good way to get caught by the security police!
TR
Truman
2 years ago
Encrypting the secrets at rest is crucial for security. I'm glad they're providing a step-by-step on how to set that up. Can't wait to try it out!
NI
Niesha
2 years ago
Whoa, that's a handy trick to check the secrets in etcd! But I wonder if there's a more secure way to manage those secrets, ya know, without exposing them in the clear.
AS
Asuncion
1 year ago
Using encryption is a more secure way to manage secrets in etcd.
BL
Blondell
1 year ago
It's important to ensure all secrets are encrypted with the new configuration.
LA
Laurel
1 year ago
Yes, AES-CBC encryption provider can be used to encrypt secret data at rest.
TR
Tracie
2 years ago
You can use encryption configuration to secure the secrets in etcd.
SA
Samira
2 years ago
That's true. We need to ensure all secrets are encrypted with the new configuration.
CE
Celestina
2 years ago
Yes, we can use the etcdctl command utility to find the secret value.
SA
Samira
2 years ago
I think storing secrets in etcd is not secure at rest.