<p>I am reading Core Kubernetes by Vyas and Love. Section 8.3.1 has the following 2 yaml files.  Let's call them <code>secret.yaml</code>:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
data:
  val1: YXNkZgo=
  val2: YXNkZjIK
stringData:
  val1: asdf
</code></pre>
<p>and <code>secret-pod.yaml</code>:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: mysecretpod
spec:
  containers:
  - name: mypod
    image: nginx
    volumeMounts:
    - name: myval
      mountPath: /etc/myval
      readOnly: true
  volumes:
  - name: myval
    secret:
      secretName: val1
</code></pre>
<p>When I run <code>kubectl apply -f secret-pod.yaml</code>, it errors out.  Using <code>describe</code>, I can see this:</p>
<pre><code>Events:
  Type     Reason       Age              From               Message
  ----     ------       ----             ----               -------
  Normal   Scheduled    3s               default-scheduler  Successfully assigned default/mysecretpod to minikube
  Warning  FailedMount  0s (x4 over 3s)  kubelet            MountVolume.SetUp failed for volume &quot;myval&quot; : secret &quot;val1&quot; not found
</code></pre>
<p>This kinda makes sense.  Using <code>kubectl get secrets</code>, I can only see the following:</p>
<pre><code>NAME                  TYPE                                  DATA   AGE
default-token-vhllg   kubernetes.io/service-account-token   3      5d3h
mysecret              Opaque                                2      19m
</code></pre>
<p>So I make the following change to <code>secret-pod.yaml</code>:</p>
<pre><code>  volumes:
  - name: myval
    secret:
      secretName: mysecret
</code></pre>
<p>That makes <code>kubectl</code> happy and it promptly creates <code>mysecretpod</code> without any issue.  However looking into that pod using <code>kubectl exec -it mysecretpod -- ls -l /etc/myval</code>, I get:</p>
<pre><code>total 0
lrwxrwxrwx 1 root root 11 Dec 12 08:08 val1 -&gt; ..data/val1
lrwxrwxrwx 1 root root 11 Dec 12 08:08 val2 -&gt; ..data/val2
</code></pre>
<p>So the content of <code>mysecret</code> is loaded into that folder with <code>val1</code> and <code>val2</code> being files.  I think the authors intend to mount <code>val1</code> to be the <code>/etc/myval</code> files in that pod.  How should <code>secret-pod.yaml</code> be written to achieve that?  I have tried this but it fails:</p>
<pre><code>  volumes:
  - name: myval
    secret:
      secretName: mysecret/val1
</code></pre>
<p>Also, why am I seeing the extraneous <code> -&gt; ..data/val...</code> for both <code>val1</code> and <code>val2</code>?  What are they?</p>

CaTx
<p>So for it to work as intended, <code>secret-pod.yaml</code> must specify <code>subPath</code> as follows:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: mysecretpod
spec:
  containers:
  - name: mypod
    image: nginx
    volumeMounts:
    - name: myval
      mountPath: /etc/myval
      subPath: myval
      readOnly: true
  volumes:
  - name: myval
    secret:
      secretName: mysecret
      items:
      - key: val1
        path: myval
</code></pre>
