# Knowledge Check: Configuration & Secrets

---

**1. A teammate says "our database password is safe because it's stored as a Kubernetes
Secret." What's missing from that statement?**

*Answer:* A Secret's data is base64-ENCODED, not encrypted — anyone who can read the Secret
object at all can trivially decode it. The real protection is RBAC (who is allowed to read
Secrets in that namespace) and, on a properly configured cluster, encryption at rest — not the
Secret object type itself.

---

**2. Why does Kubernetes have two separate objects (ConfigMap and Secret) instead of one
"Config" object with a sensitivity flag?**

*Answer:* Keeping them separate makes the distinction enforceable via RBAC — a role can grant
"read ConfigMaps" without granting "read Secrets" — and makes it visible at a glance
(`kubectl get configmaps` never risks accidentally listing something sensitive).

---

**3. An application needs its configuration to change without rebuilding its container image
across dev/staging/production. Which Kubernetes mechanism solves this, and why not just bake
different configs into three separate images?**

*Answer:* ConfigMaps (and Secrets, for sensitive values) injected at runtime via env vars or a
mounted volume. Baking config into the image means maintaining three separate images for what
should be identical application code — externalizing configuration lets the SAME image run
correctly in every environment.

---

**4. True or false: mounting a ConfigMap as a volume and consuming it as environment variables
are functionally identical from the application's perspective.**

*Answer:* False. An application reading environment variables needs code that reads env vars; an
application expecting a config FILE on disk needs the volume-mount approach. The right choice
depends on how the application itself is written to read configuration, not just personal
preference.

## Instructor Notes

**Facilitation:** Question 1 is the single most important takeaway from this module — confirm
it's genuinely understood, not just correctly guessed, before moving to the Labs.

**Approximate timing:** 5-7 minutes.