Question

A fintech company runs a set of microservices on GKE that connect to a Cloud SQL database. Currently, the database password is stored as a plaintext value in a Kubernetes ConfigMap. A security audit has flagged this as a critical finding. The security team requires that credentials be centrally stored, encrypted at rest, access-controlled via IAM, and that every credential access be auditable. Which approach best satisfies these requirements?

Accepted Answer

Store the database password in Secret Manager, grant each microservice's service account the Secret Manager Secret Accessor role via Workload Identity, and read the secret at runtime.

Answer

Move the password into a Kubernetes Secret object, which is base64-encoded, and restrict access using Kubernetes RBAC.

Answer

Encrypt the password with a Cloud KMS key and embed the resulting ciphertext directly in the container image so it ships with the application.

Answer

Store the password in a Cloud Storage bucket with uniform bucket-level access and grant the microservices Storage Object Viewer.