<p>My namespace contains multiple secrets and pods. The secrets are selectively mounted on pods as volumes using the deployment spec. Is it possible to deny specific secrets from being mounted as volumes in certain pods. I have tested RBAC and it prevents pods from accessing secrets over api. Is there a similar mechanism for mounted secrets considering that there is a security risk in allowing all secrets to be mounted in pods in the same namespace.</p>

<p>The other answer is the correct one but in the interest of completeness, you could write an admission controller which checks requests against some kind of policy. This is what the built in NodeRestriction admission controller does to help limit things so the kubelet can only access secrets for pods it is supposed to be running. </p>
