How do you manage secrets such as database passwords and API keys across CI/CD pipelines and Kubernetes?
What the interviewer wants to hear
- Never store secrets in Git or images in plain text
- Central secret manager such as Vault or cloud secret managers
- Short-lived credentials via OIDC or workload identity
- Sync into Kubernetes with External Secrets or CSI driver; encrypt etcd
- Least privilege, rotation and audit logging
Model answer
My first rule is that secrets never go into Git, Docker images or logs. I keep them in a central store such as HashiCorp Vault or AWS Secrets Manager. In CI, I avoid long-lived keys by using OIDC federation, so each pipeline job gets short-lived cloud credentials for a role scoped to that repo and branch. In Kubernetes, I use the External Secrets Operator or the Secrets Store CSI driver to pull values from the secret manager, and workload identity so Pods authenticate without static keys. Kubernetes Secrets are only base64 encoded, so I enable encryption at rest for etcd and restrict access with RBAC. Every secret has an owner, the narrowest possible permissions, automatic rotation where possible, and access is audit logged. I also run secret scanning on repos to catch mistakes early.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium DevOps Engineer questions
- A Pod is stuck in CrashLoopBackOff after a deployment. How do you troubleshoot it?
- Compare rolling, blue-green and canary deployments. How do you decide which to use?
- Developers complain that the CI pipeline takes 40 minutes. How would you make it faster?
- How do you structure Terraform code for multiple environments like dev, staging and production?
- Your team is burning out from on-call pages. How would you redesign alerting and the on-call process?
- When would you package Kubernetes manifests with Helm and when with Kustomize? Can they be combined?
- Users report that one service on Kubernetes became slow since this morning. Walk me through how you would investigate.
- How would you promote a release from dev to staging to production in a GitOps setup with Argo CD?
- How do you include database schema migrations in a continuous delivery pipeline without causing downtime?