1Z0-997-25 Question 66
Select 2You have a web application deployed on Oracle Container Engine for Kubernetes (OKE) that uses database credentials stored as a secret in OCI Vault. Due to compliance requirements, these credentials must be rotated automatically every 60 days. Which TWO actions should you implement to enable this automated secrets rotation properly?
- A
Create an OCI Function that updates the database password and creates a new secret version in the Vault, triggered by an OCI Events rule at a 60-day interval.
- B
Use a dynamic group to grant OKE nodes permission to read the secret, then store the updated credentials in a Kubernetes secret for the pods to consume automatically.
- C
Configure an Autonomous Database trigger that updates the secret within OCI Vault whenever database login activity is detected.
- D
Enable an 'Auto-Rotate' check box in the Vault console to have the system rotate the secret automatically every 60 days.
- E
Redeploy the entire OKE cluster each time the password is changed so that pods always retrieve the new credentials at startup.
Show answer and explanation
Correct answers: A, B
Explanation
To automate database credential rotation in OCI Vault, you can set up a serverless function that both updates the database password and creates a new version of the secret in the Vault. OCI Events can trigger this function on a specific schedule, fulfilling compliance requirements. Additionally, ensure your OKE clusters can access the secret by assigning correct IAM policies via dynamic groups. Refer to Oracle documentation on 'Secure Secret Management with OCI Vault' and the 'OCI Functions and Events integration' for step-by-step instructions.
- A. Correct.
Correct. This is a common approach to automate secrets rotation. You can use an OCI Function to update the database user� password and create a new secret version in Vault, and trigger it via an OCI Events rule on a schedule or based on any relevant event. This ensures the updated secret is stored securely, and the rotation is automated.
- B. Correct.
Correct. OKE worker nodes (or pods) must be able to retrieve the secret from Vault. Defining a dynamic group and policy grants them permission to read the secret. You can synchronize that updated secret into a Kubernetes secret for the pods, ensuring minimal disruption when credentials rotate.
- C. Incorrect.
Incorrect. There is no native mechanism where an Autonomous Database trigger directly updates a secret in OCI Vault. While you can integrate various OCI services, triggers in the database do not automatically rotate Vault secrets on login events.
- D. Incorrect.
Incorrect. OCI Vault does not currently provide a simple 'Auto-Rotate' toggle for secrets. Manual or function-based approaches are required to rotate secrets. The built-in auto-rotation feature only applies to vault keys, not secrets managed in Vault.
- E. Incorrect.
Incorrect. You do not need to redeploy the entire cluster every time the secret is updated. Properly implemented, the pods will fetch the latest secret from Vault or the Kubernetes secret store without cluster redeployment.