CI/CD & DevOps Practices Practice Question 10: Pipeline Secrets
CI/CD & DevOps Practices · Test 1 · question 10 of 10
A pipeline definition in a Git repository contains the production database password in plain text. The build step also passes the password into the container image so the application can read it at startup. The same image is supposed to be promoted unchanged from staging to production.
The team wants no credentials in the repository or in the built artifact, and it wants to keep promoting one artifact through every environment. Which change meets these goals?
Show answer and explanation
Answer:
Credentials are configuration: they differ between deployments, and the Twelve-Factor App calls for strict separation of config from code. Its litmus test is whether the codebase could be made open source at any moment without compromising any credentials. Keeping the secret in a store and supplying it at deploy or run time, for example as an environment variable, keeps it out of both the repository and the image. The same image can then run in every environment with different values (B). Because the password is already in Git history, it should also be rotated; editing the file alone does not remove the old value.
Option A is encoding, not encryption. Anyone who can read the repository can decode it, so the credential is still in the code.
Option C narrows who can see the secret, but the password is still in the repository and still fails the open-source litmus test. The image problem is also untouched.
Option D puts the credential into an artifact, where it can be read from the image, and creates a production-only build. That breaks the rule of using the same package in every environment.
References: The Twelve-Factor App: Config; Deployment automation (dora.dev)