Mastering Kubernetes - Second Edition

Using secrets in a container

Containers can access secrets as files by mounting volumes from the pod. Another approach is to access the secrets as environment variables. Finally, a container (given its service account has the permission) can access the Kubernetes API directly or use the kubectl get secret.

To use a secret mounted as a volume, the pod manifest should declare the volume, and it should be mounted in the container's spec:

{ "apiVersion": "v1", "kind": "Pod", "metadata": { "name": "pod-with-secret", "namespace": "default" }, "spec": { "containers": [{ "name": "the-container", "image": "redis", "volumeMounts": [{ "name": "secret-volume", "mountPath": "/mnt/secret-volume", "readOnly": true }] }], "volumes": [{ "name": "secret-volume", ...