The utility billing API on OKE needs a database password and an OCIR pull credential at runtime. Where should those credentials live relative to ConfigMaps and the container image?
Select an answer to reveal the explanation.
Short Explanation
Passwords and pull tokens are secrets—store them in a Kubernetes Secret (Vault comes later), not in a ConfigMap or the image. A Secret is still a cluster object, so treat it as sensitive, not as “safe to paste in chat.”
Full Explanation
Runtime credentials such as database passwords, OCIR pull tokens, and API keys belong in Kubernetes Secrets (with Vault-backed patterns covered in a later domain), not in ConfigMaps or image layers. ConfigMaps are for non-secret settings. Dockerfile ENV and Service annotations are poor places for credentials and increase leak risk. Secrets remain sensitive cluster objects requiring access control.