Skip to content
Cheat sheets

003 · Domain 9: Access management architecture · 5% of the exam

Task 9.2: Describe the Vault Secrets Operator

A Kubernetes operator that syncs Vault secrets into Kubernetes Secrets through custom resources, refreshes and rollout restarts, dynamic secret leases, the encrypted client cache and instant updates.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A Deployment's pods read database credentials from a Kubernetes Secret through environment variables. The credentials come from Vault's database secrets engine, and the pods cannot reload them while running. When the Vault Secrets Operator replaces the credentials, the pods must pick them up. Which configuration fits?

  1. AA VaultDynamicSecret for the database path with rolloutRestartTargets naming the Deployment
  2. BA VaultStaticSecret for the database path with refreshAfter set
  3. CA VaultDynamicSecret for the database path with no further settings
  4. DVault Agent injector annotations on the Deployment's pod template
Show the answer and why

  • AA VaultDynamicSecret for the database path with rolloutRestartTargets naming the Deployment

    Correct

    VaultDynamicSecret syncs dynamic credentials, and rollout restart targets restart workloads that cannot reload a rotated secret.

  • BA VaultStaticSecret for the database path with refreshAfter set

    Incorrect

    VaultStaticSecret syncs KV v1 and v2 secrets, not dynamic database credentials.

  • CA VaultDynamicSecret for the database path with no further settings

    Incorrect

    The Secret would be updated, but running pods keep the environment variables they started with.

  • DVault Agent injector annotations on the Deployment's pod template

    Incorrect

    The injector renders files into a shared volume; it does not maintain the Kubernetes Secret the pods read.

VSO writes Vault secrets into Kubernetes Secrets; for consumers that only read secrets at start, add rollout restart targets.

HashiCorp documentation

Task 9.2Report a problem with this question

Question 2 · choose 1

In the Vault Secrets Operator, which custom resource defines how to log in to Vault, with the auth method, mount, role and service account?

  1. AVaultAuth
  2. BVaultConnection
  3. CVaultStaticSecret
  4. DVaultPKISecret
Show the answer and why

  • AVaultAuth

    Correct

    VaultAuth provides the authentication configuration for a VaultConnection.

  • BVaultConnection

    Incorrect

    VaultConnection holds the address and TLS settings, not the login.

  • CVaultStaticSecret

    Incorrect

    That describes one secret to sync.

  • DVaultPKISecret

    Incorrect

    That describes certificates to sync.

VaultConnection and VaultAuth are foundational resources used by every secret resource.

HashiCorp documentation

Task 9.2Report a problem with this question

Question 3 · choose 1

A VaultStaticSecret syncs a KV v2 secret into a Kubernetes Secret. What does its refreshAfter setting control?

  1. AHow long the Kubernetes Secret lives before deletion
  2. BThe TTL of the KV secret's lease
  3. CHow often the operator re-reads the secret from Vault
  4. DHow often the pods consuming it restart
Show the answer and why

  • AHow long the Kubernetes Secret lives before deletion

    Incorrect

    The destination Secret stays; refreshAfter governs re-syncs.

  • BThe TTL of the KV secret's lease

    Incorrect

    KV secrets have no leases.

  • CHow often the operator re-reads the secret from Vault

    Correct

    refreshAfter sets the interval at which the static secret is synced again.

  • DHow often the pods consuming it restart

    Incorrect

    Restarts are set with rollout restart targets.

Set refreshAfter to match how quickly a change in Vault must reach the Kubernetes Secret.

HashiCorp documentation

Task 9.2Report a problem with this question

Question 4 · choose 1

A team wants Kubernetes Secrets synced by the Vault Secrets Operator to change as soon as the KV secret changes in Vault. What does that require?

  1. AA refreshAfter of 0s, which polls continuously
  2. BVault Community Edition, which pushes changes by default
  3. CA VaultDynamicSecret for the KV path
  4. DInstant updates on Vault Enterprise 1.16.3 or later
Show the answer and why

  • AA refreshAfter of 0s, which polls continuously

    Incorrect

    Polling intervals are not instant updates and add load.

  • BVault Community Edition, which pushes changes by default

    Incorrect

    Instant updates require Vault Enterprise.

  • CA VaultDynamicSecret for the KV path

    Incorrect

    KV secrets are synced with VaultStaticSecret.

  • DInstant updates on Vault Enterprise 1.16.3 or later

    Correct

    VSO subscribes to Vault events for VaultStaticSecret; the feature needs Vault Enterprise 1.16.3 or later.

Keep a refresh interval anyway, because event delivery is not guaranteed.

HashiCorp documentation

Task 9.2Report a problem with this question

Question 5 · choose 1

After a Vault Secrets Operator upgrade, dynamic credentials were reissued because the operator lost track of its leases. Which feature prevents that?

  1. ASetting a short refreshAfter on every VaultDynamicSecret resource
  2. BPersisting the client cache, encrypted with transit
  3. CRunning two operator replicas without any cache
  4. DStoring the credentials in KV before upgrades
Show the answer and why

  • ASetting a short refreshAfter on every VaultDynamicSecret resource

    Incorrect

    Refresh intervals do not keep the operator's tokens and leases.

  • BPersisting the client cache, encrypted with transit

    Correct

    The client cache stores tokens and leases so they keep being renewed through leadership changes; encryption uses transit.

  • CRunning two operator replicas without any cache

    Incorrect

    Without the cache, lease state is not carried across.

  • DStoring the credentials in KV before upgrades

    Incorrect

    Copies in KV do not keep the leases tracked.

Client cache persistence is off by default because it needs extra configuration and Vault setup.

HashiCorp documentation

Task 9.2Report a problem with this question

Practice domain 9 →Practice all domains →