<p>i'm learning docker/k8s; I want to pass/store a .pem file to my boostrap container which runs on a k8s cluster. This container uses the .pem to create a k8s secret (kubectl create secrets ...) which will be used by the other apps running on k8s by mounting the kubernetes secrets.</p>
<p>I can think of the following options,</p>
<ul>
<li>I can pass the .pem details as ENV to the container.</li>
<li>I can build the image with the .pem file.</li>
<li>I can store the .pem file in S3 and download it from within the container.</li>
</ul>
<p>Wanted to understand which of these is the best practice/secure method to accomplish this task.</p>

<p>(Although one could say that K8S Secrets are type of Config map). <br>
I think that the <strong>better approach is to use K8S Secrets (over Config maps)</strong> like specified in <a href="https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets" rel="nofollow noreferrer">here</a>.</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: secret-tls
type: kubernetes.io/tls
data:
  # the data is abbreviated in this example
  tls.crt: |
        MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
  tls.key: |
        MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
</code></pre>
<p>Then you can create a <a href="https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#create-a-pod-that-has-access-to-the-secret-data-through-a-volume" rel="nofollow noreferrer">pod that has access to the secret data through a Volume</a>:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: secret-test-pod
spec:
  containers:
    - name: test-container
      image: nginx
      volumeMounts:
        # name must match the volume name below
        - name: secret-volume
          mountPath: /etc/secret-dir
  # The secret data is exposed to Containers in the Pod through a Volume.
  volumes:
    - name: secret-volume
      secret:
        secretName: secret-tls
</code></pre>
<p>(*) In this specific example the <code>tls.crt</code> and <code>tls.key</code> will be created under <code>/etc/secret-dir</code>.</p>
