How can a Secret be consumed by a pod as files?

How can a Secret be consumed by a pod as files?

• A. Initialize the Secret as an environment variable
• B. Expose the Secret as a environment variable using envFrom
• C. Mount the Secret as a Volume
• D. Annotate the Pod with Secret data

Answer: (C)

Mounting a Secret as a Volume is the way to have secret data appear as files inside a container. In a Pod spec you reference the Secret with a volume of type Secret, then mount that volume into the container at a chosen path. Each key in the Secret becomes a separate file under that path, and the file contents are the decoded secret values. This lets applications read credentials or config directly from the filesystem. The other options place secret data into environment variables or metadata, not as files. Environment variables populate the process environment rather than creating files, and annotations are just metadata, not a mechanism to expose secret data as files.

Mounting a Secret as a Volume is the way to have secret data appear as files inside a container. In a Pod spec you reference the Secret with a volume of type Secret, then mount that volume into the container at a chosen path. Each key in the Secret becomes a separate file under that path, and the file contents are the decoded secret values. This lets applications read credentials or config directly from the filesystem.

The other options place secret data into environment variables or metadata, not as files. Environment variables populate the process environment rather than creating files, and annotations are just metadata, not a mechanism to expose secret data as files.