Build Vs Runtime Secret Injection Strategy

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise DevOps team is redesigning their continuous delivery pipeline on Google Cloud for a microservices application deployed to Google Kubernetes Engine (GKE). Currently, the pipeline passes environment-specific API keys and database credentials during the Cloud Build phase using build arguments, creating separate container images for development, staging, and production.

The team must eliminate secret exposure risks in Artifact Registry layers and build logs, maintain environment consistency by promoting an identical immutable artifact through all stages, and support rapid rollbacks and secret rotation without rebuilding images.

Which secret management and pipeline strategy should the team adopt?

Inject secrets during the Cloud Build phase using Secret Manager integrations in cloudbuild.yaml to bake separate configuration files for each environment.

Use Cloud Build multi-stage Docker builds to inject secrets into an intermediate build layer and delete the secrets before generating the final image.

Commit encrypted secret bundles into the source repository and decrypt them during container startup using a symmetric KMS key baked into the base image.

Build a single, environment-agnostic container image in Cloud Build and inject secrets dynamically at runtime from Secret Manager into GKE workloads.

Professional Cloud DevOps Engineer

Build Vs Runtime Secret Injection Strategy

Related questions