Question

You maintain a Deployment whose Pods consume a Secret named db-creds. The security team rotates the Secret in place with 'kubectl apply', updating the password key. Your application reads the password only at request time (re-reading the file on each request), and you want running Pods to pick up the new value WITHOUT triggering a rollout or restarting the Pods. Which method of consuming the Secret in the Pod spec meets this requirement?

Accepted Answer

Mount the Secret as a volume using 'volumes' and 'volumeMounts', reading the password from the mounted file path

Answer

Inject the Secret key into an environment variable using 'valueFrom.secretKeyRef'

Answer

Reference the entire Secret with 'envFrom.secretRef' to load all keys as environment variables

Answer

Use a projected volume with 'defaultMode: 0400' but disable the kubelet sync loop for the Pod