CKAD Practice Question: Application Environment, Configuration and Security
You need to create a Secret of type kubernetes.io/tls for use with an Ingress. Which kubectl command should you use?
⚠ Common exam trap
It's easy for candidates to confuse the `--from-file` pattern (used with `generic` secrets) with the `tls` subcommand, or mistakenly think any secret containing a cert and key will work for Ingress, when in fact the secret must be of type `kubernetes.io/tls` with the exact keys `tls.crt` and `tls.key`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret tls my-tls --cert=cert.pem --key=key.pem
`kubectl create secret tls` is the dedicated command for creating a TLS secret, which automatically stores the certificate and key under the expected keys `tls.crt` and `tls.key` respectively. This secret type (`kubernetes.io/tls`) is required by Ingress controllers to serve HTTPS traffic, and the command directly accepts `--cert` and `--key` flags for the PEM-encoded files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kubectl create secret tls my-tls --cert=cert.pem --key=key.pem
Why this is correct
This command correctly creates a Secret with type kubernetes.io/tls by using the dedicated --cert and --key flags. kubectl reads the PEM-encoded certificate and private key, stores them under the canonical data keys tls.crt and tls.key, and sets the type so Ingress resources can consume it for TLS termination. No other command form produces a TLS-typed Secret with both required data fields.
- ✗
kubectl create secret docker-registry my-tls --docker-username=user --docker-password=pass
Why it's wrong here
The `create secret docker-registry` subcommand generates a Secret for authenticating with a container image registry, not a TLS certificate. It fails because the question requires a Secret of type `kubernetes.io/tls`, which stores a TLS certificate and private key, whereas `docker-registry` produces type `kubernetes.io/dockerconfigjson` for registry credentials. This option is tempting because it also uses the `create secret` pattern and involves credentials, but it would be correct only when configuring an Ingress to pull images from a private registry, not for TLS termination.
- ✗
kubectl create secret generic my-tls --from-file=cert.pem --from-file=key.pem
Why it's wrong here
While this creates a Secret, it uses the generic subcommand, which produces type Opaque rather than kubernetes.io/tls. The data keys are derived from the source filenames cert.pem and key.pem, not the required tls.crt and tls.key, so Ingress controllers will not recognize it as a TLS secret. Both the type and the key names prevent this from satisfying the requirement.
- ✗
kubectl create secret tls my-tls --from-file=tls.crt --from-file=tls.key
Why it's wrong here
Although this invokes the tls subcommand, the --from-file flag is not valid for `kubectl create secret tls`; that subcommand only accepts --cert and --key. The --from-file flag is a generic-secret feature, and using it here causes a CLI parsing error rather than producing a Secret. Even if it did work, it would not place data under the canonical tls.crt/tls.key keys required by Ingress.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.