<p>I am following Kubernetes documentations on <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">secret</a>.  I have this <code>secret.yaml</code> file:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  val1: YXNkZgo=
stringData:
  val1: asdf
</code></pre>
<p>and <code>secret-pod.yaml</code>:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: mysecretpod
spec:
  containers:
  - name: mypod
    image: nginx
    volumeMounts:
    - name: myval
      mountPath: /etc/secret
      readOnly: true
  volumes:
  - name: myval
    secret:
      secretName: val1
      items:
      - key: val1
        path: myval
</code></pre>
<p>I use <code>kubectl apply -f</code> on both of these files.  Then using <code>kubectl exec -it mysecretpod -- cat /etc/secret/myval</code>, I can see the value <code>asdf</code> in the file <code>/etc/secret/myval</code> of <code>mysecretpod</code>.</p>
<p>However I want the mounted path to be <code>/etc/myval</code>.  Thus I make the following change in <code>secret-pod.yaml</code>:</p>
<pre><code>    volumeMounts:
    - name: myval
      mountPath: /etc
      readOnly: true
</code></pre>
<p>After using <code>kubectl apply -f</code> on that file again, I check pod creation with <code>kubectl get pods --all-namespaces</code>.  This is what I see:</p>
<pre><code>NAMESPACE     NAME                               READY   STATUS             RESTARTS      AGE
default       mysecretpod                        0/1     CrashLoopBackOff   2 (34s ago)   62s
</code></pre>
<p>Looking into that pod using <code>kubectl describe pods mysecretpod</code>, this is what I see:</p>
<pre><code>Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  35s               default-scheduler  Successfully assigned default/mysecretpod to minikube
  Normal   Pulled     32s               kubelet            Successfully pulled image &quot;nginx&quot; in 2.635766453s
  Warning  Failed     31s               kubelet            Error: failed to start container &quot;mypod&quot;: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: rootfs_linux.go:76: mounting &quot;/var/lib/docker/containers/c84a8d278dc2f131daf9f322d26ff8c54d68cea8cd9c0ce209f68d7a9b677b3c/resolv.conf&quot; to rootfs at &quot;/etc/resolv.conf&quot; caused: open /var/lib/docker/overlay2/4aaf54c61f7c80937a8edc094b27d6590538632e0209165e0b8c96e9e779a4b6/merged/etc/resolv.conf: read-only file system: unknown
  Normal   Pulled     28s               kubelet            Successfully pulled image &quot;nginx&quot; in 3.313846185s
  Warning  Failed     28s               kubelet            Error: failed to start container &quot;mypod&quot;: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: rootfs_linux.go:76: mounting &quot;/var/lib/docker/containers/c84a8d278dc2f131daf9f322d26ff8c54d68cea8cd9c0ce209f68d7a9b677b3c/resolv.conf&quot; to rootfs at &quot;/etc/resolv.conf&quot; caused: open /var/lib/docker/overlay2/34af5138f14d192ade7e53211476943ea82cd2c8186d69ca79a3adf2abbc0978/merged/etc/resolv.conf: read-only file system: unknown
  Warning  BackOff    24s               kubelet            Back-off restarting failed container
  Normal   Pulling    9s (x3 over 34s)  kubelet            Pulling image &quot;nginx&quot;
  Normal   Created    7s (x3 over 32s)  kubelet            Created container mypod
  Normal   Pulled     7s                kubelet            Successfully pulled image &quot;nginx&quot; in 2.73055072s
  Warning  Failed     6s                kubelet            Error: failed to start container &quot;mypod&quot;: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: rootfs_linux.go:76: mounting &quot;/var/lib/docker/containers/c84a8d278dc2f131daf9f322d26ff8c54d68cea8cd9c0ce209f68d7a9b677b3c/resolv.conf&quot; to rootfs at &quot;/etc/resolv.conf&quot; caused: open /var/lib/docker/overlay2/01bfa6b2c35d5eb12ad7ad204a5acc58688c1e04d9b5891382e48c26d2e7077f/merged/etc/resolv.conf: read-only file system: unknown
</code></pre>
<p>Why does this fail?  Is it possible to have a secret mounted at the <code>/etc</code> level instead of <code>/etc/something</code> level?  If yes, how can I achieve that?  Thank you so much!</p>

<pre><code>volumeMounts:
- name: myval
  mountPath: /etc
  readOnly: true
</code></pre>
<p>Instead of /etc <strong>directory</strong>, try mount as a single file:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: nginx
type: Opaque
stringData:
  val1: asdf
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:alpine
    volumeMounts:
    - name: myval
      mountPath: /etc/myval
      subPath: myval
  volumes:
  - name: myval
    secret:
      secretName: nginx
      items:
      - key: val1
        path: myval
...
</code></pre>
