KCNA · Question #172
What default level of protection is applied to the data in Secrets in the Kubernetes API?
The correct answer is D. The values are base64 encoded. Kubernetes Secrets store data using base64 encoding by default, which obfuscates the data but does not encrypt it at rest.
Question
What default level of protection is applied to the data in Secrets in the Kubernetes API?
Options
- AThe values use AES Symmetric Encryption
- BThe values are stored in plain text
- CThe values are encoded with SHA256 hashes
- DThe values are base64 encoded
How the community answered
(43 responses)- A7% (3)
- C2% (1)
- D91% (39)
Why each option
Kubernetes Secrets store data using base64 encoding by default, which obfuscates the data but does not encrypt it at rest.
Kubernetes Secrets do not apply AES symmetric encryption by default to the data values themselves within the API.
While base64 encoding is not true encryption, it is not stored as literal plain text; it requires decoding to reveal the original value.
SHA256 hashes are used for integrity checks or one-way password storage, not for encoding reversible data in Kubernetes Secrets.
Kubernetes Secrets store sensitive data as base64 encoded strings by default. This encoding is merely an obfuscation method, not an encryption method, meaning the data is easily decodable and therefore not protected at rest without additional configuration like encryption at rest for the etcd database.
Concept tested: Kubernetes Secrets data protection default
Source: https://kubernetes.io/docs/concepts/configuration/secret/#security-properties
Topics
Community Discussion
No community discussion yet for this question.