CI/CD & Deployment interview question · Most asked
How should secrets be handled in CI/CD pipelines?
Summary
Store secrets in the CI secret store or a vault, scope them to environments and protected branches, prefer short-lived credentials via OIDC federation (e.g., GitHub Actions to AWS/GCP) over long-lived keys, mask them in logs, and never expose them to untrusted pull requests from forks.
Longer Answer
Rotate secrets and audit access; scan repositories for accidentally committed secrets.
Key Points
- Secret stores / vaults
- OIDC short-lived credentials
- Environment scoping
- No secrets for fork PRs
- Rotation and scanning
More most-asked CI/CD & Deployment questions
- What's the difference between continuous integration, continuous delivery and continuous deployment?
- What stages does a typical CI/CD pipeline contain?
- Compare rolling, blue-green and canary deployments.
- How do you run database migrations without downtime?
- What are best practices for writing Dockerfiles?
- What's the difference between liveness and readiness probes?