<p>I do have an existing application that used docker and docker compose so far. I want to operate this app in a Kubernetes cluster. Shouldn't be a big deal, right? But so far I failed because of the used secrets.</p>
<p>The application expects a secret to be present in a file at: <code>/run/secrets/webhook_secret</code>, where <code>webhook_secret</code> is the file containing the secret.</p>
<p>I created a secret with kubectl like this:</p>
<pre><code>   kubectl create secret                                                       
      generic webhook-secret \
      --from-literal=webhook_secret=123 \
      --namespace my-app
</code></pre>
<p>I tried to mount the secret in the manifest with...</p>
<pre><code>  ...
  volumeMounts:
  - name: secrets
    mountPath: &quot;/run/secrets&quot;
    readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: webhook-secret
  ...
</code></pre>
<p>But then the pod is not able to start, as Kubernetes also tries to mount the same directory and so issues with run/secrets/kubernetes.io occur...</p>
<p><code>Warning  Failed     3m1s (x4 over 3m37s)   kubelet            Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting &quot;/var/lib/kubelet/pods/e79f634a-2abe-4c47-ae50-c4beb5b66ae6/volumes/kubernetes.io~projected/kube-api-access-grl42&quot; to rootfs at &quot;/var/run/secrets/kubernetes.io/serviceaccount&quot;: mkdir /run/containerd/io.containerd.runtime.v2.task/k8s.io/my-app-container/rootfs/run/secrets/kubernetes.io: read-only file system: unknown</code></p>
<p>Any idea how I can provide the secret as required by the application?</p>
<p>Regards and thanks,
Thomas</p>

<p>It might be perfectly possible to mount your own secrets into the <code>/var/run/secrets</code> or <code>/run/secrets</code> path. Even in the scenario where Kuberbetes is concurrently using that path for system-related tasks. This commonly happens when, for instance,  you are running a cluster with 2+ nodes and Kubernetes starts projecting it's system objects like secrets, tokens, certifates, etc. into <code>/var/run/secrets/kubernetes.io/serviceaccount/</code>.</p>
<p>I don't know the exact specifics of your case, but you might want to look into <code>subPath</code>. When your application expects secrets to be available in <code>/run/secrets</code>, you can do so something like:</p>
<pre><code>...
containers:
    - name: myContainer
      image: &quot;someImage:1.0.0&quot;
volumeMounts:
  - name: mySecretVolumeName
    mountPath: &quot;/run/secrets/webhook_secret&quot;
    readOnly: true
    subPath: webhook-secret
volumes:
  - name: mySecretVolumeName
    secret:
      secretName: secrets
      items:
        - key: webhook-secret
          path: webhook-secret
...
</code></pre>
<p>People started bumping into the issue you're experiencing (if I understand you correctly) a few years ago: <a href="https://github.com/kubernetes/kubernetes/issues/65835" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/65835</a></p>
<p>Hope this helps you out!</p>
