Per‑Pod Secrets in Kubernetes: 3 Patterns Compared, Benchmarked, and Migrated

During a Q4 rollout, a 150‑node cluster leaked a 30‑day‑old API key for 12 minutes, costing the company $4,200 in unauthorized third‑party calls.

1️⃣ Baseline: Kubernetes Secret as a Volume

How the default mount works

Kubernetes lets you reference a Secret object in a pod spec and mount it as a volume. The API server injects the secret data into an etcd‑backed object, the kubelet creates a tmpfs mount, and every container in the pod sees the same files under /etc/secret, similar to what we documented in our secrets management work. Example:

apiVersion: v1