How would you secure secrets in a CI/CD pipeline that deploys to Kubernetes?
Quick Answer
Store secrets in a dedicated secret manager, inject them at runtime, and avoid hardcoding them into images, logs, or source control.
Detailed Answer
Secrets should never be embedded in code, images, or plain-text config files. The pipeline should retrieve them at runtime from a secure secret store and pass them only to the steps that need them. In Kubernetes, this usually means using a Secret object, mounted files, or a runtime injector with scoped access.
The operational model should minimize blast radius. That means least-privilege access, short-lived credentials, and separate secrets for different environments.
The hidden trap is that security is not just a tool issue. It is also a process issue involving rotation, auditing, and clear ownership.
Good answers connect the technical controls to the broader governance model, showing that the engineer understands both implementation and risk.
This is important because a compromise of a CI system can expose multiple environments if secrets are reused carelessly.
Code Example
# Example Kubernetes Secret creation kubectl create secret generic payments-db --from-file=./db-password.txt
Interview Tip
A senior answer should explain secret handling in terms of least privilege, rotation, and runtime injection rather than just naming a tool.