Google Professional Cloud DevOps Engineer Question 221
Single answerGoogle Cloud PlatformYou are deploying a containerized application on Google Kubernetes Engine (GKE) that requires a sensitive API key to access a third-party service. The API key must not be exposed in the container image or be accessible to unauthorized users. Which approach should you use to inject the secret into the application securely during runtime?
- A
Embed the API key directly into the container image during the build process.
- B
Store the API key in a ConfigMap and mount it as a volume in the container.
- C
Use Secret Manager to store the API key and configure the application to fetch it at runtime using the Secret Manager API.
- D
Store the API key in a Kubernetes Secret and mount it as an environment variable in the container.
Show answer and explanation
Correct answer: C
Explanation
Secrets should not be embedded in container images or stored in insecure mechanisms like ConfigMaps. Using Secret Manager to manage secrets provides a robust, secure solution that allows secrets to be dynamically fetched at runtime, minimizing the risk of exposure and ensuring secure access control. While Kubernetes Secrets offer some level of security, dynamically fetching secrets from a dedicated service like Secret Manager is a best practice for runtime secret injection.
- A. Incorrect.
Embedding the API key directly into the container image during the build process is insecure as the secret would be included in the image and could be exposed if the image is shared or compromised.
- B. Incorrect.
While ConfigMaps can store configuration data, they are not designed for sensitive information as they do not provide encryption at rest. Using ConfigMaps for secrets is not recommended.
- C. Correct.
Using Secret Manager to store the API key ensures that the secret is managed securely and fetched only when needed during runtime. This reduces the risk of exposing the secret in the build process or in Kubernetes manifests.
- D. Incorrect.
Although Kubernetes Secrets are encrypted at rest, mounting them as environment variables can potentially expose them in process-level details (e.g., in a process dump). This is less secure compared to fetching secrets dynamically at runtime from a dedicated secret management system.