1Z0-997-25 Question 64
Select 2You manage a containerized microservice in Oracle Container Engine for Kubernetes (OKE) that uses credentials stored in an OCI Vault for accessing an Autonomous Database. The credentials are rotated regularly. You want to ensure the microservice always retrieves the latest credentials from the Vault automatically, without requiring manual restarts or redeployment. Which two approaches can you implement to accomplish this requirement? (Choose two.)
- A
A. Use the OCI Secrets Store CSI driver to mount the latest version of the secret as a volume in the Kubernetes pod.
- B
B. Set up a custom Event Rule that triggers on secret rotation to update an environment variable in the microservice pods directly.
- C
C. Configure Resource Principals so the microservice can call the OCI Vault API at runtime to retrieve the current secret version.
- D
D. Embed the secret into a Kubernetes ConfigMap to ensure it is always available without direct OCI Vault integration.
- E
E. Schedule a CronJob to restart the pods periodically, forcing them to pick up the latest credentials from the Vault.
Show answer and explanation
Correct answers: A, C
Explanation
To automate secrets management with OCI Vault, you can use mechanisms that allow your workload to pull the latest secret version at runtime or automatically mount it via a trusted driver. Using the OCI Secrets Store CSI driver (Option A) or calling the Vault API with Resource Principals (Option C) are both recommended patterns. These approaches are documented under OCI Secrets Management best practices: https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/managingsecrets.htm
- A. Correct.
A. Correct. The OCI Secrets Store CSI driver lets Kubernetes pods mount secrets from OCI Vault directly, ensuring that whenever the secret is rotated in the Vault, the CSI driver provides the updated version to the pod without manual restarts.
- B. Incorrect.
B. Incorrect. While event rules in OCI can detect secret rotation, there is no native mechanism to dynamically update environment variables in an already running pod. You would need additional orchestration logic, and it still might require redeployment or restarts.
- C. Correct.
C. Correct. By configuring Resource Principals, your microservice can securely call the OCI Vault API to retrieve the latest secret version at runtime. This approach allows the microservice to fetch updated credentials without requiring manual restarts.
- D. Incorrect.
D. Incorrect. Placing secrets into a ConfigMap breaks the direct integration with OCI Vault. A ConfigMap does not automatically pull updates when a secret rotates, and it would require manual updates or redeployments.
- E. Incorrect.
E. Incorrect. Restarting pods on a schedule is a workaround that forces a fresh pull of credentials only at fixed intervals, and does not truly automate the process based on actual secret rotation events. This does not guarantee the microservice is always using the latest credentials.