<p>When secrets are created, they are 0755 owned by root:</p>

<pre><code>/ # ls -al /var/run/secrets/
total 0
drwxr-xr-x    4 root     root            52 Apr 16 21:56 .
drwxr-xr-x    1 root     root            21 Apr 16 21:56 ..
drwxr-xr-x    3 root     root            28 Apr 16 21:56 eks.amazonaws.com
drwxr-xr-x    3 root     root            28 Apr 16 21:56 kubernetes.io
</code></pre>

<p>I want them to be <code>0700</code> instead. I know that for regular secret volumes I can use</p>

<pre><code>            - name: vol-sec-smtp
              secret:
                defaultMode: 0600
                secretName: smtp
</code></pre>

<p>and it will mount (at least the secret files themselves) as 0600. Can I achieve the same with the secrets located at <code>/var/run/secrets</code> directly from the yaml file?</p>

graywolf
<p>You can disable the default service account token mount and then mount it yourself as you showed.</p>
