CKS Minimize Microservice Vulnerabilities Practice Question
You are configuring encryption at rest for Kubernetes secrets. After creating an EncryptionConfiguration with aescbc provider, which additional step is required to enable encryption?
⚠ Common exam trap
A common pitfall is thinking that creating the EncryptionConfiguration resource is sufficient. In reality, the kube-apiserver must be configured with the --encryption-provider-config flag and restarted to activate encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restart the kube-apiserver with --encryption-provider-config flag
The EncryptionConfiguration resource defines how Kubernetes should encrypt data at rest, but it is not automatically applied. The kube-apiserver must be restarted with the `--encryption-provider-config` flag pointing to the configuration file so that it reads and enforces the encryption settings for all subsequent writes to etcd. Without this flag, the apiserver ignores the EncryptionConfiguration entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restart the kube-apiserver with --encryption-provider-config flag
Why this is correct
The kube-apiserver reads --encryption-provider-config only at process startup, so the configuration file must be in place and the control plane component restarted for the change to take effect. This flag points to a YAML/JSON file that defines how to encrypt secrets at the etcd level. Without the restart, the apiserver continues using its previous, unencrypted write path. This is the required first step before any existing data can be migrated to encrypted form.
- ✗
Apply the EncryptionConfiguration as a ConfigMap
Why it's wrong here
EncryptionConfiguration is an API object in the apiserver.config.k8s.io/v1 group, not a ConfigMap, and merely applying it with kubectl does not register it with the running kube-apiserver. The apiserver does not watch this resource dynamically; it only reads an on-disk file at startup as specified by --encryption-provider-config. Administrators must place the file on the control plane host and restart the apiserver process. Treating it as a ConfigMap misunderstands both its kind and the required activation mechanism.
- ✗
Restart the kube-scheduler
Why it's wrong here
The kube-scheduler is responsible only for binding pods to nodes and does not perform any etcd read/write operations on secrets or other API resources. Encryption at rest is enforced by the kube-apiserver because it is the sole component with direct access to etcd's storage. Restarting the scheduler will not alter how secrets are persisted and provides no path toward enabling encryption. The correct control-plane component to modify and restart is the apiserver, not the scheduler.
- ✗
Recreate all secrets in the cluster
Why it's wrong here
Recreating secrets is a necessary follow-up to encrypt existing data, but it does not by itself enable encryption at rest. If the apiserver has not been started with --encryption-provider-config, newly created secrets are still written to etcd in plaintext. The proper sequence is to first restart the apiserver with the encryption configuration, then rotate or recreate secrets so writes use the new encryption keys. Performing a mass recreation before configuring the apiserver is therefore ineffective and also disruptive.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.