<p>I am mounting a k8s secret as a volume mount, and the files in the pod have the wrong permissions. </p>

<p>In my <code>Deployment</code> I have this entry in the <code>volumes</code> array: </p>

<pre><code>        - name: ssh-host-keys
          secret:
            secretName: ftp-ssh-host-keys
            defaultMode: 0600
</code></pre>

<p>which is then mounted like this:</p>

<pre><code>            - mountPath: /etc/ssh/ssh_host_rsa_key
              name: ssh-host-keys
              subPath: ssh_host_rsa_key
              readOnly: true
</code></pre>

<p>However, when I look at the files in the <code>Pod</code> the file permissions are incorrect:</p>

<pre><code>rw-r--r-- 1 root root 553122 Aug 21  2018 moduli
-rw-r--r-- 1 root root   1723 Aug 21  2018 ssh_config
-rw-r----- 1 root 1337    410 May 11 10:33 ssh_host_ed25519_key
-rw-r----- 1 root 1337   3242 May 11 10:33 ssh_host_rsa_key
-rw-r--r-- 1 root 1337    465 May 11 10:33 sshd_config
</code></pre>

<p>i.e. the keys have permissions 0644 instead of 0600.</p>

<p>I don't know why this might be happening.</p>

<p>According to the <a href="https://kubernetes.io/docs/concepts/configuration/secret/#secret-files-permissions" rel="noreferrer">documentation</a>, owing to JSON limitations, you must specify the mode in decimal notation.</p>

<p>Look to the example provided in the documentation: </p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: mypod
    image: redis
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
  volumes:
  - name: foo
    secret:
      secretName: mysecret
      defaultMode: 256
</code></pre>

<p>256 decimal is equivalent to 0400 in octal. In your specific case, you should use <code>defaultMode: 384</code> to get 0600 to have the desired permissions. </p>

<p>You can convert octal permissions <a href="https://www.rapidtables.com/convert/number/octal-to-decimal.html" rel="noreferrer">here</a>. </p>
