<p>I use one secret to store multiple data items like this:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: my-certs
  namespace: my-namespace
data:
  keystore.p12: LMNOPQRSTUV
  truststore.p12: ABCDEFGHIJK
</code></pre>

<p>In my <code>Deployment</code> I mount them into files like this:</p>

<pre><code>volumeMounts:
- mountPath: /app/truststore.p12
    name: truststore-secret
    subPath: truststore.p12
- mountPath: /app/keystore.p12
    name: keystore-secret
    subPath: keystore.p12
volumes:
- name: truststore-secret
secret:
    items:
    - key: truststore.p12
    path: truststore.p12
    secretName: my-certs
- name: keystore-secret
secret:
    items:
    - key: keystore.p12
    path: keystore.p12
    secretName: my-certs
</code></pre>

<p>This works as expected but I am wondering whether I can achieve the same result of mounting those two secret as files with less Yaml? For example <code>volumes</code> use <code>items</code> but I could not figure out how to use one volume with multiple <code>items</code> and mount those.</p>

Hedge
<p>Yes, you can reduce your yaml with <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-projected-volume-storage/" rel="noreferrer">Projected Volume</a>.</p>

<blockquote>
  <p>Currently, <code>secret</code>, <code>configMap</code>, <code>downwardAPI</code>, and <code>serviceAccountToken</code> volumes can be projected.</p>
</blockquote>

<p><strong>TL;DR use this structure in your <code>Deployment</code>:</strong></p>

<pre><code>spec:
  containers:
  - name: {YOUR_CONTAINER_NAME}
    volumeMounts:
    - name: multiple-secrets-volume
      mountPath: "/app"
      readOnly: true
  volumes:
  - name: multiple-secrets-volume
    projected:
      sources:
      - secret:
          name: my-certs
</code></pre>

<p>And here's the full reproduction of your case, first I registered your <code>my-certs</code> secret:</p>

<pre><code>user@minikube:~/secrets$ kubectl get secret my-certs -o yaml
apiVersion: v1
data:
  keystore.p12: TE1OT1BRUlNUVVY=
  truststore.p12: QUJDREVGR0hJSks=
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"keystore.p12":"TE1OT1BRUlNUVVY=","truststore.p12":"QUJDREVGR0hJSks="},"kind":"Secret","metadata":{"annotations":{},"name":"my-certs","namespace":"default"}}
  creationTimestamp: "2020-01-22T10:43:51Z"
  name: my-certs
  namespace: default
  resourceVersion: "2759005"
  selfLink: /api/v1/namespaces/default/secrets/my-certs
  uid: d785045c-2931-434e-b6e1-7e090fdd6ff4
</code></pre>

<p>Then created a <code>pod</code> to test the access to the <code>secret</code>, this is <code>projected.yaml</code>:</p>

<pre><code>user@minikube:~/secrets$ cat projected.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: test-projected-volume
spec:
  containers:
  - name: test-projected-volume
    image: busybox
    args:
    - sleep
    - "86400"
    volumeMounts:
    - name: multiple-secrets-volume
      mountPath: "/app"
      readOnly: true
  volumes:
  - name: multiple-secrets-volume
    projected:
      sources:
      - secret:
          name: my-certs

user@minikube:~/secrets$ kubectl apply -f projected.yaml 
pod/test-projected-volume created
</code></pre>

<p>Then tested the access to the keys:</p>

<pre><code>user@minikube:~/secrets$ kubectl exec -it test-projected-volume -- /bin/sh
/ # ls
app   bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ # cd app
/app # ls
keystore.p12    truststore.p12
/app # cat keystore.p12 
LMNOPQRSTUV/app # 
/app # cat truststore.p12 
ABCDEFGHIJK/app # 
/app # exit
</code></pre>

<p>You have the option to use a single <code>secret</code> with many data lines, as you requested or you can use many secrets from your base in your deployment in the following model:</p>

<pre><code>    volumeMounts:
    - name: all-in-one
      mountPath: "/projected-volume"
      readOnly: true
  volumes:
  - name: all-in-one
    projected:
      sources:
      - secret:
          name: SECRET_1
      - secret:
          name: SECRET_2
</code></pre>
