Question

A DevSecOps engineer is hardening a containerized microservice deployment on Kubernetes. During a review, the security team discovers that database passwords and API keys are being passed to containers as plaintext environment variables defined directly in the Deployment manifest, which is stored in a Git repository. The team wants to eliminate secret exposure both at rest in source control and at runtime within the container. Which approach BEST addresses both concerns?

Accepted Answer

Integrate an external secrets manager with a CSI driver that mounts secrets as ephemeral volumes at runtime and remove secrets from the manifests

Answer

Move the secrets into Kubernetes ConfigMaps and restrict RBAC access to the namespace

Answer

Base64-encode the environment variable values in the Deployment manifest before committing them to Git

Answer

Store the secrets in native Kubernetes Secrets objects and commit the Secret manifests alongside the Deployment in Git