How do you store secrets in Kubernetes?
Quick Answer
Options: native Kubernetes Secrets (base64, not encrypted by default), external stores via the Secrets Store CSI driver (AWS Secrets Manager, Azure Key Vault), or HashiCorp Vault with injection. Enable encryption at rest and tight RBAC for native Secrets.
Detailed Answer
Kubernetes Secrets are only base64-encoded in etcd, so enable encryption at rest (EncryptionConfiguration or a KMS provider) and restrict access with RBAC. For stronger posture, keep secrets in an external manager and mount them via the CSI driver or Vault Agent, which supports dynamic, short-lived, auto-rotated credentials. Never commit secrets to Git — use sealed-secrets or SOPS for GitOps.
Interview Tip
The must-say caveat: native Secrets are base64, not encrypted — enable encryption at rest or use Vault/CSI, and never commit secrets to Git.