File permissions specify whether the file owner, owning group, and other users can read, write, or execute a file. Secret and ConfigMap volume files default to 0644: the owner can read and write, while the group and others can only read. section 9.5.4
Set a volume’s defaultMode to change permissions; for example, 0740 grants the owner full access and the group read access. In YAML, include the leading zero for octal notation; JSON uses decimal. Files are symbolic links, so use ls -lL to inspect the target file’s permissions. section 9.5.4
Restricting permissions can prevent a container process from accessing mounted files if group ownership is not set appropriately. section 9.5.4
volumes:
- name: cert-and-key
secret:
secretName: kiada-tls
items:
- key: tls.key
path: example-com.key
mode: 0640 #1
This volume manifest shows a per-file mode for a Secret key. section 9.5.4
