An OKE workload for the city’s 311 app needs a production API token. Developers propose checking a Kubernetes Secret YAML with the live token into the Helm chart repo. What is the correct production approach?
Select an answer to reveal the explanation.
Short Explanation
A Kubernetes Secret is a delivery tray inside the Pod; Vault is the locked cabinet that actually owns the password. Never photocopy the cabinet contents into git.
Full Explanation
Kubernetes Secret objects are how a Pod can see a value at runtime, but production credentials should remain in OCI Vault. The workload uses workload identity or another documented principal to retrieve the current secret bundle and may project it into the process. Checking Secret YAML with live credentials into a chart repo is a leak.