CKS Minimize Microservice Vulnerabilities Practice Question
You need to encrypt secrets at rest in a Kubernetes cluster. What must be configured?
⚠ Common exam trap
It's easy for candidates to think encryption at rest can be achieved via a webhook or a feature gate, but in reality it requires a specific configuration file passed to the kube-apiserver, and no feature gate or environment variable exists for this purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an EncryptionConfiguration object in the cluster and pass it to kube-apiserver via --encryption-provider-config
Kubernetes encrypts secrets at rest by defining an EncryptionConfiguration object that specifies which encryption providers (e.g., AES-CBC, secretbox, or KMS) to use, and then passing the configuration file to the kube-apiserver via the `--encryption-provider-config` flag. This ensures that when the API server writes secrets to etcd, they are encrypted before storage, and decrypted on read, meeting the requirement for encrypting secrets at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an EncryptionConfiguration object in the cluster and pass it to kube-apiserver via --encryption-provider-config
Why this is correct
The Kubernetes API server encrypts resources at the storage layer by reading an EncryptionConfiguration file supplied via the --encryption-provider-config flag. This configuration defines providers — such as aescbc, kms, or secretbox — and which resource types (like secrets) are encrypted before being written to etcd. The API server must be restarted with this flag, and the configuration file must be mounted into the API server pod or accessible on the host.
- ✗
Set the environment variable ENCRYPT_SECRETS=true on the kube-controller-manager
Why it's wrong here
The kube-controller-manager does not handle storage or etcd access; it reconciles controllers by communicating through the API server's REST API. There is no official ENCRYPT_SECRETS environment variable, and setting unknown variables on a control plane component has no effect on encryption behavior. Encryption at rest is exclusively configured at the kube-apiserver layer, not via environment variables on other components.
- ✗
Use a MutatingWebhookConfiguration to encrypt secrets before storage
Why it's wrong here
A MutatingWebhookConfiguration runs as an admission controller that can modify resource objects during API requests, but it operates before the object is persisted and cannot intercept or control the raw bytes written to etcd. Any attempt to encrypt a Secret in a webhook would produce a Secret whose data field is encrypted text, breaking transparency for controllers that expect plaintext. Encryption at rest is a storage-layer feature of the API server, not a function of admission webhooks.
- ✗
Enable the 'SecretEncryption' feature gate on all control plane components
Why it's wrong here
Feature gates are command-line toggles for enabling alpha or beta functionality in individual Kubernetes components, but they cannot configure encryption details like which keys to use or which resources to encrypt. Even if a 'SecretEncryption' gate existed, it would not create an encryption configuration or tell the API server how to encrypt data; enabling or disabling a gate does not install a provider. Encryption at rest is opt-in via a dedicated configuration file, not a feature gate on all control plane components.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.