CKAD Practice Question: Application Environment, Configuration and Security
A developer wants to inject database credentials into a pod as environment variables. The credentials are stored in a Kubernetes Secret named 'db-creds' with keys 'username' and 'password'. Which pod spec snippet correctly injects both values as environment variables?
⚠ Common exam trap
A common mix-up: candidates confuse `envFrom` with `env` and use `secretKeyRef` under `envFrom` (Option D) or mistakenly use `configMapRef` for secrets (Option B), failing to recognize that `envFrom` requires `secretRef` to inject all keys from a Secret.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
envFrom: - secretRef: name: db-creds
`envFrom` with `secretRef` injects all key-value pairs from a Secret as environment variables into the pod. This directly satisfies the requirement to inject both 'username' and 'password' from the 'db-creds' Secret without needing to specify each key individually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
env: - name: username valueFrom: secretKeyRef: name: db-creds key: username
Why it's wrong here
This approach uses the `env` field with `valueFrom.secretKeyRef`, which is valid only for injecting a single key-value pair from a Secret. Here it specifies only the `username` key, so the pod receives no `password` environment variable and cannot authenticate. To inject multiple keys, you need either one `env` entry per key or an `envFrom` block referencing the entire Secret.
- ✗
envFrom: - configMapRef: name: db-creds
Why it's wrong here
The `envFrom` field only accepts `configMapRef` or `secretRef`, and using `configMapRef` here points to a ConfigMap named `db-creds`. Since the intention is to inject database credentials, which are sensitive, they must be stored in a Secret, not a ConfigMap. Additionally, even if a ConfigMap existed with that name, it would not contain the Secret data as expected, because ConfigMaps are for non-sensitive configuration.
- ✓
envFrom: - secretRef: name: db-creds
Why this is correct
The `envFrom` block with `secretRef` is the recommended way to inject all key-value pairs from a Secret as environment variables in one go. Each key in the Secret becomes an environment variable name, and the corresponding value is the decoded Secret data. This automatically provides both `username` and `password` (or any other keys) to the pod without listing them individually.
- ✗
envFrom: - secretKeyRef: name: db-creds
Why it's wrong here
This configuration is invalid because `envFrom` does not support `secretKeyRef`; it only supports `configMapRef` and `secretRef`. `secretKeyRef` is a field used under `valueFrom` within an individual `env` entry to pull a single key from a Secret. Using it under `envFrom` will cause a schema validation error, and the pod will fail to start.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.