Google Professional Cloud DevOps Engineer Question 83
Single answerGoogle Cloud PlatformYour team is deploying a containerized application to Google Kubernetes Engine (GKE). The application requires a sensitive API key to communicate with an external service. The API key must remain secure and should not be exposed in the container image. What is the best approach to manage and inject the secret into the application?
- A
Embed the API key directly in the application code and build it into the container image.
- B
Use Kubernetes Secrets to store the API key and mount it as an environment variable in the container at runtime.
- C
Encrypt the API key with Cloud KMS and store the encrypted secret in the container image.
- D
Use Kubernetes Secrets to store the API key and inject it into the container file system at runtime.
Show answer and explanation
Correct answer: B
Explanation
The best practice for managing secrets in containerized applications is to avoid embedding them in the container image and instead use runtime secret injection. Kubernetes Secrets provide a secure mechanism for managing sensitive data like API keys. Injecting the secret as an environment variable at runtime ensures that the secret is not exposed during build time or stored in the container image, reducing the risk of compromise.
- A. Incorrect.
Embedding the API key in the application code and container image is an insecure practice because it exposes the secret during build time and makes it vulnerable if the image is compromised.
- B. Correct.
Using Kubernetes Secrets to store the API key and inject it as an environment variable at runtime is a secure and recommended approach. Secrets are managed by Kubernetes and are only available during runtime, minimizing exposure.
- C. Incorrect.
Encrypting the API key with Cloud KMS and storing it in the container image still exposes the encrypted secret within the image, which compromises security.
- D. Incorrect.
While using Kubernetes Secrets to inject the API key into the file system at runtime is a valid approach, it is less secure than using environment variables, as file-based secrets can potentially be accessed by other processes or users with access to the container file system.