A city permit portal on OKE needs database credentials that operators may rotate overnight without rewriting the Pod template. How should those Secrets be injected?
Select an answer to reveal the explanation.
Short Explanation
Think of env vars as sticky notes glued on at Pod start—they stay until the Pod is recreated. A Secret mounted as a volume is more like a shared binder on the desk: operators can swap pages without reprinting the whole Pod label. Prefer volume mounts when credentials must rotate without a template rewrite.
Full Explanation
Both ConfigMaps and Secrets can be exposed as environment variables or as files in a volume. Environment injection is fixed when the Pod starts, so a rotation typically requires a new Pod. Mounting the Secret as a volume lets kubelet refresh file contents when the Secret object changes, without changing the Pod template. For overnight credential rotation on a municipal permit portal, volume injection is the intentional choice.