Certified Kubernetes Application Developer (CKAD) Practice Test

Are secrets encrypted by default in Kubernetes?

1. Yes, they are encrypted by default

2. No, they are not encrypted by default

3. Only sensitive secrets are encrypted by default

4. Only in production environments are they encrypted

The correct answer is: No, they are not encrypted by default

In Kubernetes, secrets are not encrypted by default when they are stored in the etcd datastore. This means that when you create a secret in Kubernetes, the data is base64-encoded but not encrypted, which allows for easy retrieval but does pose security risks, especially if someone gains unauthorized access to the etcd storage. It's important to implement additional security measures to protect sensitive data stored in secrets. While encryption can be configured in Kubernetes to enhance security, it is not enabled by default, and administrators must take active steps to enable it, for instance through encryption providers specified in the Kubernetes API server configuration. This knowledge is crucial for anyone involved in Kubernetes administration or application development, as it emphasizes the importance of understanding Kubernetes security practices and properly managing sensitive configuration data.