200-901 Question 98
Single answerAn application team plans to deploy a containerized web application on a Kubernetes cluster. They want to ensure that the application secrets, such as database credentials, are securely passed to the containers. As a DevOps engineer, which solution would you recommend to meet this requirement?
- A
Store the secrets as environment variables hardcoded in the container image
- B
Use Kubernetes Secrets to store and inject sensitive information into the containers
- C
Store the secrets in a plaintext file and mount it as a volume in the container
- D
Encrypt the secrets using a symmetric key and include the decryption logic in the application code
Show answer and explanation
Correct answer: B
Explanation
The correct answer is to use Kubernetes Secrets, as they provide a native and secure way to manage sensitive data in a Kubernetes environment. Secrets are stored in a base64-encoded format in etcd, and access can be restricted using Kubernetes Role-Based Access Control (RBAC). This approach ensures that sensitive data remains protected while being accessible to containers in a secure manner.
- A. Incorrect.
Hardcoding secrets in the container image is insecure because anyone with access to the image can extract the secrets. This approach does not follow security best practices.
- B. Correct.
Kubernetes Secrets are specifically designed for securely storing and managing sensitive information like passwords, tokens, and keys. They can be injected into containers as environment variables or mounted as files, and their access can be controlled via RBAC.
- C. Incorrect.
Storing secrets in a plaintext file and mounting it as a volume is insecure because the file can be easily read if the container is compromised. This approach lacks proper encryption and access control.
- D. Incorrect.
Encrypting secrets and including decryption logic in the application code adds complexity and potential vulnerabilities. If the decryption key is exposed or hardcoded, the secrets can still be compromised.