1Z0-1123-25 Question 87
Single answerYour company is migrating a containerized payment-processing application from an on-premises Docker environment to Oracle Cloud. Currently, the application� sensitive credentials (database passwords, API keys) are passed to the containers via environment variables. To enhance security and avoid rebuilding container images, your team wants to adopt Oracle Container Engine for Kubernetes (OKE) and securely inject these credentials at runtime on OCI. Which approach best meets these requirements?
- A
Build new Docker images with credentials baked into environment variables and push the images to Oracle Container Registry (OCIR).
- B
Store secrets in Oracle Vault and inject them into Kubernetes pods at runtime through secrets managed by OKE.
- C
Embed secrets in a Git repository, base64-encode them, and decode them in Kubernetes deployment manifests.
- D
Maintain secrets in a private object storage bucket and pull them during container startup.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud, a common best practice is to store sensitive information in Oracle Vault and reference those secrets from OKE using Kubernetes secrets. This approach ensures secrets are never baked into container images or source code repositories, making secret rotation and secure storage easier. Refer to Oracle� documentation on integrating Oracle Vault with Container Engine for Kubernetes for official guidelines and implementation details.
- A. Incorrect.
Option 1: Building new Docker images with credentials in environment variables forces rebuilding images whenever secrets change and stores credentials in plain text within the image. This is insecure and not ideal for dynamic secret management.
- B. Correct.
Option 2: Using Oracle Vault to securely store secrets and injecting them through Kubernetes secrets at runtime is considered a best practice. It avoids embedding sensitive data in images or code, and it integrates seamlessly with OKE.
- C. Incorrect.
Option 3: Encoding secrets in a Git repository is risky because it puts confidential data under version control. Even if base64-encoded, it� not truly secure, and key rotation becomes cumbersome.
- D. Incorrect.
Option 4: Using a private object storage bucket for secrets retrieval might complicate access control and secret rotation. It also requires additional steps to download secrets securely during container startup.