AZ-400 Question 176
Select 2Your organization is deploying a containerized web service to multiple environments (Dev, Test, and Production) using Azure Kubernetes Service (AKS). You store the container images in Azure Container Registry and want to avoid building separate images for each environment. Instead, the team needs a strategy to apply environment-specific configurations (such as API endpoints and credentials) at deployment time without modifying the Docker image. Which two approaches should you implement to achieve this goal?
- A
Use an environment variable override in each AKS deployment manifest so that environment-specific values are not baked into the image.
- B
Include all environment settings in the Dockerfile and select the appropriate settings at container runtime using a startup script.
- C
Store environment-specific credentials in the source code repository and copy them into the container image during the build phase.
- D
Mount environment-specific configuration files and secret values using Kubernetes ConfigMaps and Secrets at deployment time.
- E
Create a separate Docker image tag for each environment and rebuild the image whenever environment variables change.
Show answer and explanation
Correct answers: A, D
Explanation
In a DevOps workflow, it is a best practice to separate configuration concerns from the container image so that the same image can be promoted across multiple environments. This approach reduces overhead and ensures consistency. Injecting environment-specific variables through Kubernetes manifests (Option 1) and leveraging Kubernetes ConfigMaps/Secrets (Option 4) are recommended solutions. For more details, see Microsoft Docs on deploying containers to Kubernetes (https://learn.microsoft.com/azure/devops/pipelines/ecosystems/containers) and official Kubernetes documentation about ConfigMaps and Secrets (https://kubernetes.io/docs/concepts/configuration/configmap/).
- A. Correct.
Option 1 is CORRECT. Using environment variable overrides in the AKS deployment manifest ensures that the container image remains the same, while the environment-specific values are injected at runtime.
- B. Incorrect.
Option 2 is INCORRECT. Storing all environment settings in the Dockerfile and selecting them at runtime would still require building environment-specific images or passing complex logic into the container at startup, defeating the purpose of having a single, unified image.
- C. Incorrect.
Option 3 is INCORRECT. Storing environment-specific credentials directly in source control is a security risk, and embedding them in the container during the build phase forces you to rebuild the image whenever those credentials change.
- D. Correct.
Option 4 is CORRECT. Kubernetes ConfigMaps and Secrets are standard solutions for injecting environment-specific configuration and sensitive values into the container at runtime, without baking them into the image.
- E. Incorrect.
Option 5 is INCORRECT. Creating separate Docker image tags for each environment still ties the configuration to an image rebuild. The goal is to reuse the same base image for all environments.