Where Do Secrets Live?
How should an application get its database password in production, and what is wrong with the common approaches?
Practical scenario
The production database password is in the Helm values file in git, base64-encoded, and duplicated in the CI configuration. It has not been rotated in three years because nobody knows every place it is consumed.
What it tests
Answer it out loud first. The guide below stays closed until you ask for it, on purpose.
- Whether the candidate prefers workload identity to distributed static credentials
- Whether they think about rotation as a lifecycle, not an event
- Whether they know the exposure paths of environment variables and images
Reading a strong answer is not the same as producing one. Commit to what you would say, then compare.