Kubernetes Practical By Samson Tanimawo, PhD Published Apr 4, 2026 4 min read

Secret as Volume vs Env Var

Two ways to inject secrets. The trade-offs.

Volume mount

Files in /etc/secret. Updated when secret changes.

Pod doesn't restart on update.

Set at start. Pod restart needed to update.

Visible in process listing.

Vol for rotation-friendly. Env for pre-secret-management apps.

Most modern: vol.