What are best practices for handling credentials in OpenShift?

• A. Encode credentials in environment variables inside containers.
• B. Store credentials in Secrets, avoid embedding in images or source code, and reference secrets in pods with proper RBAC.
• C. Store credentials in ConfigMaps for easy access.
• D. Write credentials to local disk inside each container.

Answer: (B)

Handling credentials in OpenShift means using Secrets to centralize and protect sensitive data, rather than baking them into images or code or storing them in plain files. Secrets store values like passwords, tokens, and keys and can be consumed by pods in a controlled way—either mounted as files from a secret volume or exposed as environment variables. This approach keeps credentials out of container images and source control, reduces the risk of leakage, and supports rotation and auditing.

Why this is the best approach: Secrets are the proper mechanism for confidential data. They enable centralized management, access control via RBAC, and secure distribution to only the pods and service accounts that need them. You can reference a secret in a pod specification without hardcoding the value, and you can rotate credentials by updating the secret without rebuilding images.

Why the other approaches aren’t ideal: Encoding credentials directly in environment variables inside containers makes them vulnerable to exposure through process listings, logs, or accidental leaks, and it ties the credential to a specific container instance. Storing credentials in ConfigMaps is unsuitable because ConfigMaps are intended for non-confidential configuration data and are not encrypted. Writing credentials to local disk inside each container creates orphaned or stale data when containers are recreated, and it lacks centralized management and controlled access.