Where should configuration like database URLs and API keys live, and why not in the repository?
What they are really testing: Basic hygiene, and a values check. They are watching whether you distinguish secret config from non-secret config, and whether you know that deleting a committed secret does not remove it.
A real interview question
Where should configuration like database URLs and API keys live, and why not in the repository?
What most people say
drag me
“In a .env file that is gitignored.”
It is half right for local development and wrong for production. It says nothing about how the secret reaches a running container, who can read it, or how it gets rotated, which is what the question is really about.
The follow-ups they ask next
A secret gets committed to main. Walk me through your response.
Rotate first, because the secret must be assumed compromised. Then purge history and force-push if feasible, audit for any use of the old credential, and add secret scanning to CI so it cannot recur.
How does a pod get a secret without a password in the manifest?
Workload identity: the pod authenticates as its service account to the cloud IAM system, which authorises it to read specific secrets. No long-lived credential is stored anywhere.
What the interviewer is listening for
- Separates secrets from ordinary config
- Knows rotation is the first response to exposure
- Mentions workload identity or per-service access
What sinks the answer
- Suggests committing an encrypted secret and nothing else
- Thinks deleting the line fixes exposure
- One shared credential for everything
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Ordinary config comes from [the environment at runtime], secrets from [a managed secret store fetched by the workload identity]. Not the repo because [git history is permanent, so a committed secret is exposed forever]. If one leaks, [rotate it first, then clean history].”
Keep going with configuration
Foundation
What is the difference between continuous integration, continuous delivery, and continuous deployment?
Foundation
What is a container, and how is it different from a virtual machine?
Foundation
What does DevOps actually mean, and what problem was it invented to solve?
Foundation
What is infrastructure as code, and why is it better than clicking in a console?
Foundation
Why should the same build artifact be promoted through environments instead of rebuilding for each one?
Foundation
What is the difference between git merge and git rebase, and when would you use each?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free