<p>Unable to mount a Kubernetes secret to <code>${HOME}/.ssh/id_rsa</code> path.</p>
<p>Following are my secrets.yaml created using</p>
<pre><code>  kubectl create secret generic secret-ssh-auth --type=kubernetes.io/ssh-auth --from-file=ssh-privatekey=keys/id_rsa
</code></pre>
<pre><code>apiVersion: v1
data:
  ssh-privatekey: abcdefgh
kind: Secret
metadata:
  name: secret-ssh-auth
  namespace: app
type: kubernetes.io/ssh-auth
---
apiVersion: v1
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
kind: Secret
metadata:
  name: mysecret
  namespace: app
type: Opaque
</code></pre>
<p>Following is my <code>deployment.yaml</code></p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-helm-test
  labels:
    helm.sh/chart: helm-test-0.1.0
    app.kubernetes.io/name: helm-test
    app.kubernetes.io/instance: nginx
    app.kubernetes.io/version: &quot;1.16.0&quot;
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: helm-test
      app.kubernetes.io/instance: nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/name: helm-test
        app.kubernetes.io/instance: nginx
    spec:
      serviceAccountName: nginx-helm-test
      securityContext:
        {}
      containers:
        - name: helm-test
          securityContext:
            {}
          image: &quot;nginx:1.16.0&quot;
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http
          resources:
            {}
          env:
            - name: HOME
              value: /root
          volumeMounts:
            - mountPath: ${HOME}/.ssh/id_rsa
              name: sshdir
              readOnly: true
            - name: foo
              mountPath: /etc/foo
              readOnly: true
      volumes:
        - name: sshdir
          secret:
            secretName: secret-ssh-auth
        - name: foo
          secret:
            secretName: mysecret    


</code></pre>
<p>All I wanted is to mount  the <code>ssh-privatekey</code> value in <code>${HOME}/.ssh/id_rsa</code> but for some reason, the above mount does not happen</p>
<p>But at the same time, I was able to see the <code>foo</code> secret correctly in <code>/etc/foo/username</code>. Exhaust to be honest but still want to finish this</p>
<p>What am I doing wrong?</p>

<p>K8s Secret <a href="https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets" rel="nofollow noreferrer">type: kubernetes.io/ssh-auth</a> (i.e. ssh-key-secret) does not work out of the box as mount point for <code>SSH</code>, since it mounts it under the filename <code>ssh-privatekey</code>. To fix this you have to do few things:</p>
<ol>
<li>You need to mount the <code>ssh-privatekey</code> key to <code>id_rsa</code> filename via <a href="https://kubernetes.io/docs/concepts/configuration/secret/#projection-of-secret-keys-to-specific-paths" rel="nofollow noreferrer">secret:items:key projection</a> in your volume definition.</li>
<li>Mount the secret so it is NOT group/world readable because the <a href="https://kubernetes.io/docs/concepts/configuration/secret/#secret-files-permissions" rel="nofollow noreferrer">default mode/permissions</a> is <code>0644</code> (i.e. add <code>defaultMode: 0400</code> to your VolumeMount) .</li>
</ol>
<p>Here is what I believe you need to change in your <code>deployment.yaml</code> to fix this problem:</p>
<pre class="lang-yaml prettyprint-override"><code>...
          volumeMounts:
            - mountPath: ${HOME}/.ssh
              name: sshdir
              readOnly: true
      volumes:
        - name: sshdir
          secret:
            secretName: secret-ssh-auth
            defaultMode: 0400
         items:
           - key: ssh-privatekey
             path: id_rsa
</code></pre>
