Search code examples
kuberneteskubernetes-secrets

Advantage of using volume secrets over usual volume mounting

I was wondering if there is any advantage of using secrets over standard file mounting in Kubernetes. I have to provide credentials, saved on the host machine to one of pods and just cannot understand what are the pros of using them.

Solution

  • The main idea of using secrets is to reduce exposure and make it more secure. It was specifically designed for this. As per documentation:

    • The data in the secrets is encoded (base64)
    • Secrets can only be referenced from the same namespace
    • A secret is only sent to a node if a pod on that node requires it. It is stored into a tmpfs and not written to disk. Once the pod that is using the secret is gone, kubelet will delete its local copy of the secret on that node.
    • You can set access rights (e.g 644)
    • If there are several secrets for several pods on the same node, one pod will not have access to the secrets of another pod, only the one that it asks for