<p>I have 3 different Kubernetes Secrets and I want to mount each one into its own Pod managed by a StatefulSet with 3 replicas.</p>

<p>Is it possible to configure the StatefulSet such that each Secret is mounted into its own Pod?</p>

dippynark
<p>Not really. A StatefulSet (and any workload controller for that matter) allows only a single pod definition template (it could have multiple containers). The issue with this is that a StatefulSet is designed to have N replicas so can you have an N number of secrets. It would have to be a SecretStatefulSet: a different controller. </p>

<p>Some solutions:</p>

<ul>
<li><p>You could define a single <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Kubernetes secret</a> that contains all your required secrets for all of your pods. The downside is that you will have to share the secret between the pods. For example:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  pod1: xxx
  pod2: xxx
  pod3: xxx
  ...
  podN: xxx
</code></pre></li>
<li><p>Use something like <a href="https://www.vaultproject.io/" rel="nofollow noreferrer">Hashicorp's Vault</a> and store your secret remotely with keys such as <code>pod1</code>, <code>pod2</code>, <code>pod3</code>,...<code>podN</code>. You can also use an <a href="https://en.wikipedia.org/wiki/Hardware_security_module" rel="nofollow noreferrer">HSM</a>. This seems to be the more solid solution IMO but it might take longer to implement.</p></li>
</ul>

<p>In all cases, you will have to make sure that the number of secrets matches your number of pods in your StatefulSet.</p>
