<p>I am trying to pass user credentials via Kubernetes secret to a mounted, password protected directory inside a Kubernetes Pod.
The NFS folder <code>/mount/protected</code> has user access restrictions, i.e. only certain users can access this folder.</p>

<p>This is my Pod configuration:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  volumes:
  - name: my-volume
    hostPath:
      path: /mount/protected
      type: Directory
    secret:
      secretName: my-secret
  containers:
  - name: my-container
    image: &lt;...&gt;
    command: ["/bin/sh"]
    args: ["-c", "python /my-volume/test.py"]
    volumeMounts:
    - name: my-volume
      mountPath: /my-volume
</code></pre>

<p>When applying it, I get the following error:</p>

<pre><code>The Pod "my-pod" is invalid:
* spec.volumes[0].secret: Forbidden: may not specify more than 1 volume type
* spec.containers[0].volumeMounts[0].name: Not found: "my-volume"
</code></pre>

<p>I created my-secret according to the following guide:<br>
<a href="https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#create-a-secret" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#create-a-secret</a><br>
So basically:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: my-secret
data:
  username: bXktYXBw
  password: PHJlZGFjdGVkPg==
</code></pre>

<p>But when I mount the folder <code>/mount/protected</code> with:</p>

<pre><code>spec:
  volumes:
  - name: my-volume
    hostPath:
      path: /mount/protected
      type: Directory
</code></pre>

<p>I get a permission denied error <code>python: can't open file '/my-volume/test.py': [Errno 13] Permission denied</code> when running a Pod that mounts this volume path.</p>

<p>My question is how can I tell my Pod that it should use specific user credentials to gain access to this mounted folder?</p>

Jonas
<p>You're trying to tell Kubernetes that <code>my-volume</code> should get its content from <em>both</em> a host path and a Secret, and it can only have one of those.</p>

<p>You don't need to manually specify a host path.  Kubernetes will figure out someplace appropriate to put the Secret content and it will still be visible on the <code>mountPath</code> you specify within the container.  (Specifying <code>hostPath:</code> at all is usually wrong, unless you can guarantee that the path will exist with the content you expect on <em>every</em> node in the cluster.)</p>

<p>So change:</p>

<pre class="lang-yaml prettyprint-override"><code>volumes:
- name: my-volume
  secret:
    secretName: my-secret
  # but no hostPath
</code></pre>
