AZ-305 Question 189
Select 2You are designing a configuration management solution for a microservices-based application running in Azure Kubernetes Service (AKS). The application runs across multiple environments (development, staging, and production) and requires frequent configuration changes without redeployment. You also need to store and manage secrets securely, ensuring that only authorized microservices can access them. Which of the following solutions should you recommend to address these requirements effectively?
- A
Store all configurations in Azure App Configuration, referencing secrets from Azure Key Vault via Key Vault references.
- B
Rely on environment variables for all configuration and secrets, manually updating them in each AKS node.
- C
Use Azure Storage with Shared Access Signatures to store a JSON file containing both public and private configuration data.
- D
Store non-secret configurations in Azure App Configuration and secrets in Azure Key Vault, referencing them at runtime through managed identities.
Show answer and explanation
Correct answers: A, D
Explanation
Azure App Configuration is designed for storing and managing non-secret application settings in a centralized and dynamic manner, helping you roll out changes without redeploying the application. For sensitive information, Azure Key Vault provides encryption at rest, strict access policies, and features like secret versioning and rotation. Combining these services (App Configuration for non-secrets and Key Vault for secrets) is a recommended best practice, as described in the official Microsoft documentation: https://learn.microsoft.com/azure/azure-app-configuration/overview and https://learn.microsoft.com/azure/key-vault/general/basic-concepts.
- A. Correct.
Option 1: Correct. Storing general configuration values in Azure App Configuration and referencing secrets from Azure Key Vault is a recommended practice. By using Key Vault references inside Azure App Configuration, you securely separate secrets from non-secret data while still keeping configuration management centralized.
- B. Incorrect.
Option 2: Incorrect. While environment variables are a common approach for configuration in containers, manually updating each AKS node for frequent changes is cumbersome, error-prone, and does not provide a centralized management solution. This also increases the risk of exposing secrets in plain text across multiple nodes.
- C. Incorrect.
Option 3: Incorrect. Using Azure Storage with Shared Access Signatures for storing a JSON file containing secrets is less secure and more complex to maintain compared to specialized services like Key Vault and App Configuration. It also does not offer the built-in mechanisms for secret rotation, access policies, and dynamic configuration changes that App Configuration and Key Vault provide.
- D. Correct.
Option 4: Correct. Splitting non-secret configurations (stored in Azure App Configuration) and secrets (stored in Azure Key Vault) is a best practice. Leveraging managed identities ensures that only authorized microservices can retrieve the secrets from Key Vault without embedding credentials in code or configuration files.