<p>I define a Secret:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
stringData:
  config.yaml: |-
    apiUrl: "https://my.api.com/api/v1"
    username: Administrator
    password: NewPasswdTest11
</code></pre>

<p>And then creating volume mount in Deployment:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8s-webapp-test
  labels:
    name: k8s-webapp-test
    version: 1.0.4
spec:
  replicas: 2
  selector:
    matchLabels:
      name: k8s-webapp-test
      version: 1.0.4
  template:
    metadata:
      labels:
        name: k8s-webapp-test
        version: 1.0.4
    spec:
      nodeSelector:
        kubernetes.io/os: windows
      volumes:
      - name: secret-volume
        secret:
          secretName: string-data-secret
      containers:
      - name: k8s-webapp-test
        image: dockerstore/k8s-webapp-test:1.0.4
        ports:
        - containerPort: 80
        volumeMounts:
        - name: secret-volume
          mountPath: "/secrets"
          readOnly: false
</code></pre>

<p>So, after the deployment, I have 2 pods with volume mounts in C:\secrets (I do use Windows nodes). When I try to edit config.yaml that is located in C:\secrets folder, I get following error: </p>

<blockquote>
  <p>Access to the path 'c:\secrets\config.yaml' is denied.</p>
</blockquote>

<p>Although I marked file as readOnly false I cannot write to it. How can I modify the file? </p>

<p>As you can see <a href="https://github.com/kubernetes/kubernetes/issues/62099" rel="noreferrer">here</a> it is not possible by intention:</p>

<blockquote>
  <p>Secret, configMap, downwardAPI and projected volumes will be mounted as read-only volumes. Applications that attempt to write to these volumes will receive read-only filesystem errors. Previously, applications were allowed to make changes to these volumes, but those changes were reverted at an arbitrary interval by the system. Applications should be re-configured to write derived files to another location</p>
</blockquote>

<p>You can look into using an <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="noreferrer">init container</a> which maps the secret and then copies it to the desired location where you might be able to modify it.</p>

<p>As an alternative to the init container you might also use a <a href="https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/" rel="noreferrer">container lifecycle hook</a> i.e. a <code>PostStart</code>-hook which executes immediately after a container is created.</p>

<pre><code>lifecycle:
  postStart:
    exec:
      command:
      - "/bin/sh"
      - "-c"
      - &gt;
        cp -r /secrets ~/secrets;
</code></pre>
