A city permit portal on OKE needs database credentials that operators may rotate overnight without rewriting the Pod template. How should those Secrets be injected?
Select an answer to reveal the explanation.
Short Explanation
Think of env vars as sticky notes glued on at Pod start—they stay until the Pod is recreated. A Secret mounted as a volume is more like a shared binder on the desk: operators can swap pages without reprinting the whole Pod label. Prefer volume mounts when credentials must rotate without a template rewrite.
Full Explanation
Mounting the Secret as a volume is the right injection pattern when overnight rotation must not rewrite the Deployment Pod template. After the Secret object updates in the API server, kubelet projects the new material into the mounted files so the permit-portal containers can re-read credentials from disk (or from a projected volume refresh path the application already supports). That keeps the Pod template hash stable while operators rotate database passwords for the municipal portal. Environment-variable injection alone fails the rotation goal by concept: values are fixed when the container process starts, so a Secret change does not rewrite existing env vars. Teams then bump annotations or otherwise force a new Pod revision just to pick up credentials—exactly the template churn the scenario wants to avoid. Deployment annotations are not a Secret delivery channel. Annotations store metadata for controllers and tooling; kubelet does not treat them as a live rewrite of argv or as a credential store. Relying on annotations for passwords invents a mechanism Kubernetes does not provide and leaves secrets poorly protected. Publishing the password in a public ConfigMap key fails confidentiality and least-privilege. ConfigMaps are for non-sensitive configuration, are commonly readable more broadly, and are the wrong object type for database credentials that must stay Secret-scoped and namespace-restricted. Exam caveat: volume projection refreshes Secret files on a kubelet sync interval, but the application must actually re-open or watch those files—many frameworks cache the first password read forever, so a mount alone is not magic unless the app reloads credentials. Operational check: after rotating the Secret, confirm the mounted file contents inside a running Pod (for example with a controlled exec read of the mount path) and verify the portal reconnects successfully without a Deployment rollout, while RBAC still denies cross-namespace Secret access.