Question

A DevOps team runs a fleet of microservices in a managed Kubernetes cluster. Each service currently reads a static database password from an environment variable injected at deployment. Security audits found the same credential has not been changed in 14 months, is shared across all services, and appears in CI/CD pipeline logs. The team wants a cloud-native approach that eliminates long-lived shared credentials and provides per-service accountability. Which solution BEST addresses these requirements?

Accepted Answer

Integrate a secrets management service that issues short-lived, dynamically generated database credentials to each service identity on demand, with automatic rotation and revocation

Answer

Encrypt the shared static password at rest and inject it as a Kubernetes Secret rather than an environment variable

Answer

Store the shared password in a config file mounted from an encrypted volume and restrict file permissions to the service account

Answer

Rotate the shared password manually every 30 days and scrub it from CI/CD logs with a regex filter