How do you inject configuration and secrets into a pod, and what is the catch with Kubernetes Secrets?
What they are really testing: Whether you separate config from images and, critically, know that Secrets are only base64-encoded by default, not encrypted. That last point is a real security gap people miss.
A real interview question
How do you inject configuration and secrets into a pod, and what is the catch with Kubernetes Secrets?
What most people say
drag me
“You put secrets in a Kubernetes Secret, which keeps them safe and separate from the code.”
"Keeps them safe" is the dangerous misconception. Secrets are base64, not encrypted, so without encryption at rest and RBAC they are not actually protected. This is a frequent real-world gap.
The follow-ups they ask next
Are Kubernetes Secrets encrypted by default?
No. They are base64-encoded only. You must enable encryption at rest for etcd and restrict RBAC; otherwise anyone with API/etcd access can read them. Many teams wrongly assume they are encrypted.
How do you integrate a real secrets manager like Vault?
Use the Secrets Store CSI driver or the external-secrets operator to pull secrets from Vault or a cloud secrets manager at runtime, so the vault is the source of truth with rotation and audit, not the etcd-stored Secret.
What the interviewer is listening for
- Separates ConfigMap (config) from Secret (sensitive)
- Knows Secrets are base64, not encrypted
- Mentions encryption at rest + RBAC + external secret stores
What sinks the answer
- Thinks Secrets are encrypted
- Bakes config/secrets into the image
- No mention of encryption at rest or RBAC
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Config goes in [a ConfigMap, injected as env or files], sensitive values in [a Secret, same delivery, kept out of git]. The catch: [a Secret is base64-encoded, not encrypted]. So I [enable etcd encryption at rest, lock down RBAC, prefer mounted files over env], and for real secrets [integrate Vault or a cloud manager via the CSI driver / external-secrets].”
Keep going with kubernetes
Foundation
What problem does Kubernetes solve, and what does it actually do for you?
Foundation
What are the main components of a Kubernetes cluster (control plane and nodes)?
Foundation
What is a Pod, and why do you use a Deployment instead of creating Pods directly?
Foundation
What is a Service in Kubernetes, and what are the main types?
Junior
When would you use a Deployment versus a StatefulSet versus a DaemonSet?
Junior
What is the difference between liveness, readiness, and startup probes?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free