Topic 1 Question 171
You are developing an application that consists of several microservices running in a Google Kubernetes Engine cluster. One microservice needs to connect to a third-party database running on-premises. You need to store credentials to the database and ensure that these credentials can be rotated while following security best practices. What should you do?
Store the credentials in a sidecar container proxy, and use it to connect to the third-party database.
Configure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.
Store the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.
Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.
ユーザの投票
コメント(3)
- 正解だと思う選択肢: D
D is the answer.
https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets By default, Google Kubernetes Engine (GKE) encrypts customer content stored at rest, including Secrets. GKE handles and manages this default encryption for you without any additional action on your part.
Application-layer secrets encryption provides an additional layer of security for sensitive data, such as Secrets, stored in etcd. Using this functionality, you can use a key managed with Cloud KMS to encrypt data at the application layer. This encryption protects against attackers who gain access to an offline copy of etcd.
👍 3zellck2022/12/15 - 👍 2TNT872022/12/22
- 正解だと思う選択肢: D
Storing sensitive information such as database credentials in Kubernetes Secrets is a common and secure way to manage sensitive information in a cluster. The Cloud Key Management Service (KMS) can be used to further protect the secrets by encrypting and decrypting them, ensuring that they are protected both at rest and in transit. This combination of Kubernetes Secrets and Cloud KMS provides a secure way to manage and rotate credentials while following security best practices.
Options A and B are not recommended, as they do not provide a secure and centralized way to manage and rotate credentials. Option C is not recommended because storing secrets in an encrypted volume mount is not as secure as using a Key Management Service, as the encryption keys must still be managed and protected within the cluster.
👍 1mrvergara2023/02/12
シャッフルモード