<h2>Update</h2>

<p>Apparenlty this behavior is caused by <code>ServiceAccount</code>:
<a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#service-account-admission-controller" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#service-account-admission-controller</a></p>

<p>Which uses something called an <code>AdmissionController</code>. I guess what I'm looking for is one of the following:</p>

<ul>
<li><p>Find a setting in <code>AdmissionController</code> which skips the secrets mount for a given container (initContainer) in my case</p></li>
<li><p>Find an implementation of <code>AdmissionController</code> which has this flexibility</p></li>
<li><p>Change the location of secrets from /var/run/secrets to somewhere else</p></li>
</ul>

<h2>Original</h2>

<p>I have an initContainer which is a part of a pod a part of statefulset. I am mounting some straight forward volumes (so I can create paths/permissions before my app container starts). However as soon as I check the file system, I see a nested path with what seems to be kubernetes secrets.</p>

<p>How did this get mounted? Is this our own doing? Why this path? Can I stop the secrets from being mounted? Can i change the mount path?</p>

<pre><code>$ kubectl logs nmnode-0-0 -n test -c prep-hadoop-paths
drwxrwsrwt 4 root root 80 Aug 21 03:52 /run
/run:
total 0
drwxrwsr-x 2 1000 root 40 Aug 21 03:52 configmaps
drwxr-sr-x 3 root root 60 Aug 21 03:52 secrets

/run/configmaps:
total 0

/run/secrets:
total 0
drwxr-sr-x 3 root root 60 Aug 21 03:52 kubernetes.io

/run/secrets/kubernetes.io:
total 0
drwxrwsrwt 3 root root 140 Aug 21 03:51 serviceaccount

/run/secrets/kubernetes.io/serviceaccount:
total 0
lrwxrwxrwx 1 root root 13 Aug 21 03:51 ca.crt -&gt; ..data/ca.crt
lrwxrwxrwx 1 root root 16 Aug 21 03:51 namespace -&gt; ..data/namespace
lrwxrwxrwx 1 root root 12 Aug 21 03:51 token -&gt; ..data/token
</code></pre>

<pre><code>
      initContainers:
      - command:
        - sh
        - -c
        - umask 002; ls -ld /run; ls -lR /run; mkdir -p /var/run/secrets/credentials
          ; mkdir -p /var/opt/hdfs ; mkdir -p /var/run/configmaps ; mkdir -p /var/run/secrets/certificates
          ; ls -lR /var;
        image: ubuntu:16.04
        imagePullPolicy: IfNotPresent
        name: prep-hadoop-paths
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /var/opt
          name: data
          subPath: hadoop/var/opt
        - mountPath: /var/log
          name: logs
          subPath: hadoop
        - mountPath: /var/run
          name: var-run
          subPath: hadoop

</code></pre>

<p>As you can see from the initContainer spec, there is nowhere that I specify or require any secrets to be mounted. However they show up regardless</p>

<p>The following is the volumes listing for the pod.</p>

<pre><code>
      volumes:
      - name: mssql-master-pool-secret
        secret:
          defaultMode: 420
          secretName: mssql-master-pool-secret
      - name: controller-internal-secret
        secret:
          defaultMode: 420
          secretName: controller-internal-secret
      - emptyDir:
          medium: Memory
        name: var-run
      - configMap:
          defaultMode: 420
          name: mssql-hadoop-storage-0-configmap
        name: hadoop-config-volume
      - name: nmnode-0-agent-secret
        secret:
          defaultMode: 420
          secretName: nmnode-0-agent-secret
      - configMap:
          defaultMode: 420
          name: cluster-configmap
        name: cluster-config-volume

</code></pre>

<p>If you need more parts of the yaml please let me know.</p>

Jeff Saremi
<p>You are on a right way, as <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">Admission controller</a> is the main contributor for implementing various features via Kubernetes API. As you mentioned above <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#service-account-admission-controller" rel="nofollow noreferrer">Service Account</a> is also propagated with some admission features in Kubernetes cluster, initially bounded to the particular admission plugin called <code>ServiceAccount</code>.</p>

<p>According to the official Kubernetes <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-controller" rel="nofollow noreferrer">documentation</a>, there are special flags<code>--enable-admission-plugins</code> and <code>--disable-admission-plugins</code> included in <code>kube-apiserver</code> <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/" rel="nofollow noreferrer">configuration</a> that can be used to enable or disable admission plugins respectively.</p>

<p>By default, <code>ServiceAccount</code> admission controller plugin is enabled like described <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#which-plugins-are-enabled-by-default" rel="nofollow noreferrer">here</a>. Besides other actions, this plugin mounts volume with token data and CA certificate into the each Pod across K8s cluster for <a href="https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod" rel="nofollow noreferrer">authentication</a> to the apiserver purposes. </p>

<p>In order to deactivate <code>ServiceAccount</code> admission plugin, you can inject <code>--disable-admission-plugins=ServiceAccount</code> into the <code>kube-apiserver</code> configuration. </p>

<p>Otherwise, if you want to </p>

<blockquote>
  <p>Change the location of secrets from /var/run/secrets to somewhere else</p>
</blockquote>

<p>This is <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#service-account-admission-controller" rel="nofollow noreferrer">where</a> you can change the path to whatever you want</p>
