A secret volume projects Kubernetes Secret entries into files inside a container. Mounting sensitive values as files reduces accidental exposure through environment-variable dumps, startup logs, error reports, and inherited child-process environments. section 8.3.3 section 9.5.3
Define and mount a secret volume by:
- Declaring a volume with type secret and naming the referenced Secret through secretName. section 9.5.3
- Selecting Secret keys and destination filenames with items and path. section 9.5.3
- Mounting the volume into the target container with volumeMounts, mountPath, and usually readOnly: true. section 9.5.3
- Using defaultMode or mode for permissions, and optional: true when the Pod may start without the Secret. section 9.5.3
Projecting TLS files into Envoy
A Pod can project tls.crt and tls.key from the kiada-tls Secret as example-com.crt and example-com.key under /etc/certs, then run the generic envoyproxy/envoy:v1.14.1 image. The files can be checked with kubectl exec kiada-ssl -c envoy -- cat /etc/certs/example-com.crt.
