<p>I am having a config file as a secret in kubernetes and I want to mount it into a specific location inside the container. The problem is that the volume that is created inside the container is a folder instead of a file with the content of the secrets in it. Any way to fix it?
My deployment looks like this:</p>
<pre><code>kind: Deployment
apiVersion: apps/v1
metadata:
  name: jetty
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jetty
  template:
    metadata:
      labels:
        app: jetty
    spec:
      containers:
        - name: jetty
          image: quay.io/user/jetty
          ports:
            - containerPort: 8080
          volumeMounts:
          - name: config-properties
            mountPath: &quot;/opt/jetty/config.properties&quot;
            subPath: config.properties
          - name: secrets-properties
            mountPath: &quot;/opt/jetty/secrets.properties&quot;
          - name: doc-path
            mountPath: /mnt/storage/
          resources:
            limits:
              cpu: '1000m'
              memory: '3000Mi'
            requests:
              cpu: '750m'
              memory: '2500Mi'
      volumes:
      - name: config-properties
        configMap:
          name: jetty-config-properties
      - name: secrets-properties
        secret: 
          secretName: jetty-secrets
      - name: doc-path
        persistentVolumeClaim:
          claimName: jetty-docs-pvc
      imagePullSecrets:
      - name: rcc-quay
</code></pre>

<h3>Secrets vs ConfigMaps</h3>
<p><code>Secrets</code> let you store and manage sensitive information (e.g. passwords, private keys) and <code>ConfigMaps</code> are used for non-sensitive configuration data.<br />
As you can see in the <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">Secrets</a> and <a href="https://kubernetes.io/docs/concepts/configuration/configmap/" rel="noreferrer">ConfigMaps</a> documentation:</p>
<blockquote>
<p>A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key.</p>
</blockquote>
<blockquote>
<p>A ConfigMap allows you to decouple environment-specific configuration from your container images, so that your applications are easily portable.</p>
</blockquote>
<h3>Mounting Secret as a file</h3>
<p>It is possible to create <code>Secret</code> and pass it as a <strong>file</strong> or multiple <strong>files</strong> to <code>Pods</code>.<br />
I've create simple example for you to illustrate how it works.
Below you can see sample <code>Secret</code> manifest file and <code>Deployment</code> that uses this Secret:<br>
<strong>NOTE:</strong> I used <code>subPath</code> with <code>Secrets</code> and it works as expected.</p>
<pre><code>---
apiVersion: v1
kind: Secret
metadata:
  name: my-secret
data:
  secret.file1: |
    c2VjcmV0RmlsZTEK
  secret.file2: |
    c2VjcmV0RmlsZTIK
---
apiVersion: apps/v1
kind: Deployment
metadata:
...
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: secrets-files
          mountPath: &quot;/mnt/secret.file1&quot;  # &quot;secret.file1&quot; file will be created in &quot;/mnt&quot; directory
          subPath: secret.file1
        - name: secrets-files
          mountPath: &quot;/mnt/secret.file2&quot;  # &quot;secret.file2&quot; file will be created in &quot;/mnt&quot; directory
          subPath: secret.file2
      volumes:
        - name: secrets-files
          secret:
            secretName: my-secret # name of the Secret
            
</code></pre>
<p><strong>Note:</strong> <code>Secret</code> should be created before <code>Deployment</code>.</p>
<p>After creating <code>Secret</code> and <code>Deployment</code>, we can see how it works:</p>
<pre><code>$ kubectl get secret,deploy,pod
NAME                         TYPE                                  DATA   AGE
secret/my-secret             Opaque                                2      76s

NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/nginx   1/1     1            1           76s

NAME                         READY   STATUS    RESTARTS   AGE
pod/nginx-7c67965687-ph7b8   1/1     Running   0          76s

$ kubectl exec nginx-7c67965687-ph7b8 -- ls /mnt
secret.file1
secret.file2
$ kubectl exec nginx-7c67965687-ph7b8 -- cat /mnt/secret.file1
secretFile1
$ kubectl exec nginx-7c67965687-ph7b8 -- cat /mnt/secret.file2
secretFile2
</code></pre>
<hr />
<h3>Projected Volume</h3>
<p>I think a better way to achieve your goal is to use <a href="https://kubernetes.io/docs/concepts/storage/volumes/#projected" rel="noreferrer">projected volume</a>.</p>
<blockquote>
<p>A projected volume maps several existing volume sources into the same directory.</p>
</blockquote>
<p>In the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-projected-volume-storage/" rel="noreferrer">Projected Volume documentation</a> you can find detailed explanation but additionally I created an example that might help you understand how it works.
Using projected volume I mounted <code>secret.file1</code>, <code>secret.file2</code> from <code>Secret</code> and <code>config.file1</code> from <code>ConfigMap</code> as files into the <code>Pod</code>.</p>
<pre><code>---
apiVersion: v1
kind: Secret
metadata:
  name: my-secret
data:
  secret.file1: |
    c2VjcmV0RmlsZTEK
  secret.file2: |
    c2VjcmV0RmlsZTIK
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
data:
  config.file1: |
    configFile1  
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: all-in-one
      mountPath: &quot;/config-volume&quot;
      readOnly: true
  volumes:
  - name: all-in-one
    projected:
      sources:
      - secret:
          name: my-secret
          items:
            - key: secret.file1
              path: secret-dir1/secret.file1
            - key: secret.file2
              path: secret-dir2/secret.file2
      - configMap:
          name: my-config
          items:
            - key: config.file1
              path: config-dir1/config.file1
</code></pre>
<p>We can check how it works:</p>
<pre><code>$ kubectl exec nginx -- ls /config-volume
config-dir1
secret-dir1
secret-dir2    
$ kubectl exec nginx -- cat /config-volume/config-dir1/config.file1
configFile1
$ kubectl exec nginx -- cat /config-volume/secret-dir1/secret.file1
secretFile1
$ kubectl exec nginx -- cat /config-volume/secret-dir2/secret.file2
secretFile2
</code></pre>
<p>If this response doesn't answer your question, please provide more details about your <code>Secret</code> and what exactly you want to achieve.</p>
