Securing sensitive data stored in an object of a distributed computing environment

A method comprising:

• deploying, by one or more processors, a pod in a distributed computing environment;
• deploying, by the one or more processors, an initialization container in the pod, wherein the initialization container:
• retrieves encrypted data from an object in the distributed computing environment, the object being separate from the pod;
• retrieves a decryption key from a key source, the key source being separate from the object and the pod;
• decrypts the encrypted data using the decryption key, to thereby generate decrypted data;
• and
• overwrites the encrypted data in the object with the decrypted data;
• deploying, by the one or more processors, an application container in the pod, wherein the application container:
• retrieves the decrypted data from the object;
• and
• initializes one or more environment variables of the application container using the decrypted data;
• and
• after the application container retrieves the decrypted data from the object, the initialization container overwrites the decrypted data with the encrypted data in the object.

A non-transitory computer-readable medium comprising program code that is executable by one or more processors for causing the one or more processors to:

• deploy a pod in a distributed computing environment;
• deploy an initialization container in the pod, the initialization container being configured to:
• retrieve encrypted data from an object in the distributed computing environment, the object being separate from the pod;
• retrieve a decryption key from a key source, the key source being separate from the object and the pod;
• decrypt the encrypted data using the decryption key, to thereby generate decrypted data;
• and
• overwrite the encrypted data in the object with the decrypted data;
• and
• deploy an application container in the pod, the application container being configured to:
• retrieve the decrypted data from the object;
• and
• initialize one or more environment variables of the application container using the decrypted data;
• and
• deploy a service outside the pod, the service being configured to, after the application container retrieves the decrypted data from the object, overwrite the decrypted data in the object with the encrypted data.