Google Professional Cloud DevOps Engineer Question 84
Single answerGoogle Cloud PlatformYou are deploying a containerized application on Google Kubernetes Engine (GKE). The application requires access to a database password stored in Secret Manager. To ensure best practices for security and scalability, how should you inject the secret into your application?
- A
Store the secret in an environment variable at build time using a CI/CD pipeline.
- B
Mount the secret as a volume in the Kubernetes Pod at runtime using Kubernetes Secrets.
- C
Bake the secret into the container image during the build process.
- D
Inject the secret dynamically at runtime using the Secret Manager API within the application.
Show answer and explanation
Correct answer: B
Explanation
When dealing with secrets in containerized applications, runtime injection is a best practice for ensuring security and flexibility. Kubernetes Secrets allow secrets to be securely mounted into pods at runtime, keeping them out of the build process and container images. This approach also simplifies secret rotation and minimizes exposure. While dynamically fetching secrets from APIs like Secret Manager is an option, it adds complexity and is not always necessary if Kubernetes Secrets provide sufficient functionality.
- A. Incorrect.
Storing the secret in an environment variable at build time is insecure because the secret becomes static and embedded in the CI/CD pipeline and potentially the container image. This increases the risk of exposure.
- B. Correct.
Mounting the secret as a volume in the Kubernetes Pod at runtime using Kubernetes Secrets is the recommended approach. It ensures the secret is injected securely at runtime and avoids embedding sensitive data in the container image or the CI/CD process.
- C. Incorrect.
Baking the secret into the container image during the build process is a bad practice because the secret becomes part of the image, making it difficult to rotate and increasing the risk of exposure if the image is accessed.
- D. Incorrect.
Injecting the secret dynamically at runtime using the Secret Manager API is a valid approach, but it adds complexity to the application code and requires additional handling for authentication and API calls. It is generally not preferred if Kubernetes Secrets can handle the requirement.