QuestionQ279

Integrating applications with Google Cloud services

You are building an application consisting of several microservices that run in a Google Kubernetes Engine cluster. One microservice must connect to a third-party database operating on-premises. You need to store the database credentials and ensure they can be rotated according to security best practices. What should you do?

  • A Store the credentials in a sidecar container proxy, and use it to connect to the third-party database.
  • B Configure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.
  • C Store the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.
  • D Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.
Explanation

Kubernetes Secrets are the appropriate Kubernetes resource for storing sensitive database credentials. In GKE, application-layer Secrets encryption uses a customer-managed Cloud KMS key, providing envelope encryption and supporting Cloud KMS key-rotation practices for the Secret data stored by the cluster.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!