CKAD Practice Question: Application Environment, Configuration and Security
Which command creates a Docker registry secret from an existing Docker config file?
⚠ Common exam trap
CNCF often tests the distinction between `kubectl create secret docker-registry` (which creates a new secret from individual flags) and `kubectl create secret generic` with `--from-file` (which imports an existing config file), leading candidates to incorrectly choose option D because they assume `docker-registry` supports `--from-file`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret generic my-reg --from-file=.dockerconfigjson=config.json
`kubectl create secret generic` with `--from-file=.dockerconfigjson=config.json` creates a generic secret that stores the contents of an existing Docker config file (typically `~/.docker/config.json`) under the key `.dockerconfigjson`. This is the standard method for importing a pre-existing Docker configuration as a Kubernetes secret, which can then be used for image pull authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl create secret tls my-reg --cert=... --key=...
Why it's wrong here
The `kubectl create secret tls` subcommand is specifically designed for Kubernetes TLS certificates, not image pull credentials. It expects `--cert` and `--key` files and stores them as `tls.crt` and `tls.key` under a secret with type `kubernetes.io/tls`. Even if executed successfully, this secret would not contain a `.dockerconfigjson` data key, so the kubelet could not use it to authenticate to a registry. Therefore, it is entirely unsuitable for creating a Docker registry secret from an existing `config.json`.
- ✓
kubectl create secret generic my-reg --from-file=.dockerconfigjson=config.json
Why this is correct
This is the correct approach because `kubectl create secret generic` with `--from-file=.dockerconfigjson=config.json` directly places the contents of your existing `config.json` file under the exact data key that Kubernetes expects. The secret is created as type `Opaque`, but the kubelet reads the `.dockerconfigjson` key regardless of the secret type, so it works as an imagePullSecret. This method preserves all registry entries and authentication tokens from the original file, making it ideal when you already have a `docker login` output.
- ✗
kubectl create secret docker-registry my-reg --docker-server=... --docker-username=...
Why it's wrong here
The `docker-registry` subcommand builds a Docker config JSON from individual flags like `--docker-server`, `--docker-username`, and `--docker-password`. It does not read or incorporate an existing `config.json` file, so any existing registry credentials, identity tokens, or multiple registry entries would be lost. Moreover, it typically requires an interactive password prompt, and the resulting secret will contain only the single registry server you specify. This fails the requirement of creating a secret from an already-existent config file.
- ✗
kubectl create secret docker-registry my-reg --from-file=.dockerconfigjson=config.json
Why it's wrong here
Here the mistake is using a flag that the `docker-registry` subcommand does not support. Unlike the `generic` subcommand, `docker-registry` only accepts specific flags such as `--docker-server`, `--docker-username`, `--docker-password`, and `--docker-email`; `--from-file` is not recognized and causes an error. Even if the flag were accepted, the subcommand's implementation is tailored to assembling credentials from individual fields, so it would not correctly map an arbitrary file to the expected data structure. You must use `generic` with `--from-file` (or `docker-registry` with individual flags) to produce a valid Docker registry secret.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.