Secrets Management

How do you securely manage secrets (passwords, API keys, certificates) in a DevOps environment?

Securityintermediate

// interview question

How do you securely manage secrets (passwords, API keys, certificates) in a DevOps environment?

Sample answer

Secrets management involves storing, accessing, and rotating sensitive data securely. Best practices: 1) Never commit secrets to version control. 2) Use dedicated secrets managers (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault). 3) Inject secrets at runtime via environment variables or mounted volumes. 4) Implement least-privilege access. 5) Rotate secrets regularly. 6) Audit secret access. In Kubernetes, use external secrets operators rather than plain Secrets objects which are only base64-encoded.

Why this matters

Secrets in plain text are a security nightmare - leaked .env files, commits with passwords, and config files in logs cause breaches. Modern secrets management provides encryption at rest and in transit, access logging, automatic rotation, and centralized control. This is a critical security domain that every DevOps engineer must understand.

Code examples

HashiCorp Vault basic usage

bash

# Write a secret
vault kv put secret/myapp/config \
    db_password=supersecret \
    api_key=abc123

# Read a secret
vault kv get secret/myapp/config

# Read specific field
vault kv get -field=db_password secret/myapp/config

# Enable audit logging
vault audit enable file file_path=/var/log/vault_audit.log

External Secrets Operator

yaml

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: app-secrets-k8s
  data:
  - secretKey: database-password
    remoteRef:
      key: prod/myapp/database
      property: password

Common mistakes to avoid

Storing secrets in environment variables in Dockerfiles (visible in image history)
Using Kubernetes Secrets without encryption (they're only base64 encoded)
Not rotating secrets after a team member leaves

Likely follow-ups

How would you implement secret rotation without application downtime?
What is the difference between encryption at rest and in transit?
How do you handle secrets in CI/CD pipelines securely?

Answer out loud first, then check yourself against the model answer.

Practice all Mid-Level questions More Security questions

#security#secrets#vault#devops#best-practices

Also worth your time on this topic

Article

How to Decode a Kubernetes Secret

Kubernetes secrets store sensitive data in base64-encoded form. Learn how to safely decode and inspect these secrets using kubectl and command-line tools.

Checklist

HashiCorp Vault Secrets Management Checklist

Set up and run HashiCorp Vault in production: HA storage, TLS, auto-unseal, dynamic secrets, encryption as a service, and the policies, audit, and backups that keep it safe.

60-90 minutes

Quiz

HashiCorp Vault Secrets Management Quiz

Test how you run HashiCorp Vault in production: dynamic database credentials, leases and TTLs, least-privilege policies, AppRole and Kubernetes auth, the Transit engine, auto-unseal, audit logging, and fast revocation when something gets compromised.

20-25 minutes

Secrets Management

More Security interview questions

Also worth your time on this topic

How to Decode a Kubernetes Secret

HashiCorp Vault Secrets Management Checklist

HashiCorp Vault Secrets Management Quiz