HashiCorp Vault Associate (003) Question 242
Single answer9b Describe the Vault Secrets OperatorA platform team runs applications in Kubernetes and wants pods to consume database credentials from HashiCorp Vault without embedding static secrets in container images or manually copying values into Kubernetes Secret objects. They also want the Kubernetes Secret to stay updated if the value in Vault changes. Which solution best meets this requirement?
- A
Deploy the Vault Secrets Operator so it watches custom resources in the cluster, reads data from Vault, and syncs the values into Kubernetes Secret objects for workloads to consume
- B
Use Vault Agent Injector because it writes secrets directly into Kubernetes Secret objects and automatically reconciles them whenever Vault data changes
- C
Configure the Vault CSI provider because it is designed to create and manage native Kubernetes Secret objects that remain in sync with Vault
- D
Enable the Kubernetes auth method only, because authenticating pods to Vault automatically causes Kubernetes to mirror Vault secrets into pod environment variables
Show answer and explanation
Correct answer: A
Explanation
The best answer is Vault Secrets Operator because it is specifically intended to sync data from Vault into Kubernetes Secret objects using Kubernetes-native reconciliation patterns. This is useful when existing applications expect Kubernetes Secrets rather than reading directly from Vault or from mounted files. By contrast, Vault Agent Injector delivers secrets into pods via an injected agent, and the CSI provider mounts secrets as volumes; neither is primarily a Kubernetes Secret synchronization tool. The Kubernetes auth method is often part of the solution because it allows the operator or workload to authenticate to Vault, but it is not a delivery mechanism by itself. This distinction aligns with HashiCorp documentation for Vault Secrets Operator and the broader Vault-on-Kubernetes integration patterns.
- A. Correct.
Correct. Vault Secrets Operator is designed for Kubernetes environments where teams want to synchronize secrets from Vault into native Kubernetes Secret objects. It watches operator-specific custom resources and reconciles the desired state by reading from Vault and writing the resulting data into Kubernetes Secrets, which applications can then mount or consume as environment variables. This directly matches the requirement to avoid manual copying and to keep Kubernetes Secrets updated from Vault.
- B. Incorrect.
Incorrect. Vault Agent Injector injects a Vault Agent sidecar or init container into pods so secrets can be rendered into files in the pod at runtime. It does not primarily work by creating and reconciling Kubernetes Secret objects. A common misconception is to treat all Vault-Kubernetes integrations as interchangeable, but Injector focuses on direct secret delivery to pods rather than syncing to Kubernetes Secrets.
- C. Incorrect.
Incorrect. The Vault CSI provider mounts secrets into pods through the Container Storage Interface rather than managing native Kubernetes Secret objects as its primary function. It is useful when applications can read secrets from mounted volumes, but it is not the best answer when the stated goal is to create and maintain Kubernetes Secret objects that workloads already expect.
- D. Incorrect.
Incorrect. The Kubernetes auth method enables Kubernetes workloads or integrations to authenticate to Vault, but authentication alone does not copy secrets into Kubernetes or inject them into environment variables. Another component, such as Vault Secrets Operator, Vault Agent Injector, or a CSI-based approach, is needed to retrieve and deliver secrets after authentication.