<p>i'm learning docker/k8s; I want to pass/store a .pem file to my boostrap container which runs on a k8s cluster. This container uses the .pem to create a k8s secret (kubectl create secrets ...) which will be used by the other apps running on k8s by mounting the kubernetes secrets.</p>
<p>I can think of the following options,</p>
<ul>
<li>I can pass the .pem details as ENV to the container.</li>
<li>I can build the image with the .pem file.</li>
<li>I can store the .pem file in S3 and download it from within the container.</li>
</ul>
<p>Wanted to understand which of these is the best practice/secure method to accomplish this task.</p>

<p>I have seen it done in multiple ways but I would suggest using a config map so that then the pem file lives inside your k8s cluster and you don't have to deal with encryption within s3 and such. Also this allows your devops team to handle the maintenance rather than the app developers if you include this within the docker code</p>
<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/" rel="nofollow noreferrer">Config Map Kubernetes Docs</a></p>
<ol>
<li><p>Create the config map</p>
<pre><code>kubectl -n &lt;namespace-for-config-map-optional&gt; create configmap ca-pemstore — from-file=my-cert.pem
</code></pre>
</li>
<li><p>Add new config to your pod yaml file</p>
<pre><code> apiVersion: v1 
 kind: Pod
 metadata:
   name: &lt;some metadata name&gt;
 spec:
     containers:
     - name: &lt;container name&gt;
       image: &lt;container image&gt;
       volumeMounts:
       - name: ca-pemstore
         mountPath: /etc/ssl/certs/my-cert.pem
         subPath: my-cert.pem
         readOnly: false
       ports:
       - containerPort: 80
       command: ...
       args: ...
     volumes:
     - name: ca-pemstore
       configMap:
         name: ca-pemstore
</code></pre>
</li>
</ol>
