Senior · Docker and Kubernetes
Secrets, configuration and RBAC
What belongs in an image, a ConfigMap and a Secret?
Try explaining this aloud before opening the answer. State your assumptions and trace a boundary case.
Reveal a strong answer
An image contains versioned application artifacts. Environment-specific nonsecret configuration can come from configuration resources; credentials need a secret-management mechanism with scoped access, rotation and protected delivery.
A Kubernetes Secret is not automatically safe just because values are base64 encoded. Access control, encryption at rest, mounts/environment exposure, logs and application handling all affect confidentiality.
Use the least privileges required by the workload and do not grant an application broad cluster-admin rights. Decide how configuration reloads and credential rotation affect active clients, and test that path before an incident.
Common trap
Base64 is an encoding, not encryption, and an agent prompt is not a secret store.
Try it
A MongoDB password was baked into an image layer and later deleted in a new layer. Is it gone?
Worked solution
No: it can remain in image history/layers. Rotate it, rebuild without the secret and fix delivery through a proper runtime/build-secret mechanism. Avoid printing replacement credentials while verifying.
Change the constraint
How can a read-only root filesystem still permit the specific temporary files an application needs?
How did you do?
Self-assessment, not a compiler pass or interview score. Explain the reasoning unaided before marking understood.
Not marked. Progress stays on this browser, separate from course completion.
Primary references
Checked 2026-10-20. Use documentation for your pinned runtime, driver and tool version.