CKAD — Using Secrets

Using Secrets as Environment Variables

All Keys

apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  containers:
  - name: app
    image: busybox:1.36
    command: ["/bin/sh", "-c", "echo $DB_USER:$DB_PASS && sleep 3600"]
    envFrom:
    - secretRef:
        name: db-credentials

Specific Keys

env:
- name: DB_USER
  valueFrom:
    secretKeyRef:
      name: db-credentials
      key: username
- name: DB_PASS
  valueFrom:
    secretKeyRef:
      name: db-credentials
      key: password

Mounting Secrets as Volumes

apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  containers:
  - name: app
    image: nginx:1.27
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: db-credentials
      defaultMode: 0400

Each key becomes a file. The defaultMode: 0400 sets file permissions to read-only for the owner.

kubectl exec app -- ls /etc/secrets
# username  password

kubectl exec app -- cat /etc/secrets/password
# s3cureP@ss!

---

Next: ConfigMap vs Secret →