Skip to content
CKSMinimize Microservice VulnerabilitiesSingle nodeHard

Encrypt Secrets at rest in etcd

Scenario cks-mic-002 · about 10 minutes · 8 points · 3 grader checks

Write an EncryptionConfiguration, wire it into the API server static pod and rewrite an existing Secret so etcd holds it encrypted.

  • secrets
  • encryption-at-rest
  • etcd
  • kube-apiserver
  • static-pod

What you will practise

  • Write an EncryptionConfiguration with aescbc and identity
  • Add a flag, a hostPath volume and a mount to the kube-apiserver manifest
  • Re-encrypt existing Secrets and prove it with etcdctl

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-mic-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Secrets of this cluster are stored in etcd in plain text. Enable encryption at rest for Secrets: 1. Create the file /etc/kubernetes/enc/enc.yaml on exam-cp1 with an EncryptionConfiguration for the resource "secrets" whose first provider is "aescbc" with one key named "key1" (a random 32-byte key, base64-encoded), followed by the "identity" provider so existing plain-text data stays readable. 2. Configure the kube-apiserver to use it (flag --encryption-provider-config=/etc/kubernetes/enc/enc.yaml; the file must be visible inside the static pod). 3. Make sure the existing Secret "db-creds" in namespace "vault" is stored encrypted in etcd. Its value must not change. The API server must be healthy afterwards. Do not rebuild the cluster.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Minimize Microservice Vulnerabilities
Difficulty
Hard
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
10 minutes
Points
8
Grader checks
3
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 3 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Minimize Microservice Vulnerabilities labs

CKSMinimize Microservice VulnerabilitiesMedium

Pod Security Admission: enforce restricted

Enforce the restricted Pod Security Standard on a namespace and bring a non-compliant Deployment into line without recreating it.

Single node · ~9 min · 9 points

  • pod-security-admission
  • pod-security-standards
  • restricted
  • securitycontext
  • seccomp

goldenkube start cks-mic-001

CKSMinimize Microservice VulnerabilitiesMedium

Secrets: from environment variables to a read-only volume

Move a Secret from an environment variable to a read-only volume with restrictive file mode and make the Secret immutable.

Single node · ~8 min · 9 points

  • secrets
  • immutable
  • volumes
  • deployment
  • least-privilege

goldenkube start cks-mic-003

CKSMinimize Microservice VulnerabilitiesMedium

Isolation: remove host namespaces and privileged mode

A tenant workload shares the node's network, PID and IPC namespaces, runs privileged and mounts the host; isolate it and enforce baseline.

Single node · ~8 min · 9 points

  • isolation
  • multi-tenancy
  • host-namespaces
  • privileged
  • pod-security-admission

goldenkube start cks-mic-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.