{
  "id": "secrets-basics",
  "title": "Creating and Using Secrets",
  "category": "Configuration",
  "difficulty": "Easy",
  "type": "task",
  "weight": 5,
  "description": "## Creating and Using Secrets\n\nSecrets let you store sensitive data (passwords, tokens, keys) separately from your pod specs.\n\n**Your task:**\n\n1. Create a Secret named `app-secret` with the key `api-key` and value `supersecret`\n2. Create a Pod named `secret-reader` using `busybox:1.36` that:\n   - Mounts the secret key `api-key` as an environment variable named `API_KEY`\n   - Runs: `sleep 3600`\n\n**Verify:**\n```bash\nkubectl exec secret-reader -- env | grep API_KEY\n```",
  "hints": [
    {
      "title": "Create the Secret",
      "body": "Use `kubectl create secret generic` with `--from-literal`.",
      "command": "kubectl create secret generic app-secret --from-literal=api-key=supersecret"
    },
    {
      "title": "Reference secret in a Pod env var",
      "body": "Use `env[].valueFrom.secretKeyRef` in the container spec to map a secret key to an env var.",
      "command": "cat <<EOF | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secret-reader\nspec:\n  containers:\n  - name: reader\n    image: busybox:1.36\n    command: [\"sleep\",\"3600\"]\n    env:\n    - name: API_KEY\n      valueFrom:\n        secretKeyRef:\n          name: app-secret\n          key: api-key\nEOF"
    }
  ],
  "setup_commands": [],
  "validation": {
    "commands": [
      {
        "description": "Secret 'app-secret' exists",
        "command": "kubectl get secret app-secret -o jsonpath='{.metadata.name}'",
        "expected_output": "app-secret",
        "match": "exact"
      },
      {
        "description": "Pod 'secret-reader' is Running",
        "command": "kubectl get pod secret-reader -o jsonpath='{.status.phase}'",
        "expected_output": "Running",
        "match": "exact"
      },
      {
        "description": "Pod references the secret via env var",
        "command": "kubectl get pod secret-reader -o jsonpath='{.spec.containers[0].env[0].valueFrom.secretKeyRef.name}'",
        "expected_output": "app-secret",
        "match": "exact"
      }
    ]
  },
  "default_namespace": "default",
  "teardown_commands": [
    {
      "command": "kubectl delete secret app-secret --ignore-not-found"
    },
    {
      "command": "kubectl delete pod secret-reader --ignore-not-found --grace-period=0 --force"
    }
  ]
}