Transit mounts a TLS key pair into a gateway Pod from cluster-manag…

Question

Transit mounts a TLS key pair into a gateway Pod from cluster-managed confidential data. Which approach matches common CKA practice?

Accepted Answer

Mount a Secret as a volume so certificate and key files appear in the Pod filesystem. — TLS keys are vault material—Secrets mounted as files hand the gateway the cert and key on disk without baking them into the image. A public ConfigMap is the wrong mailbox for private keys.

Answer

Store the private key only in a public ConfigMap checked into an open Git repo.

Answer

Encode the key in a Service annotation that kube-proxy turns into TLS files.

Answer

Put the certificate material exclusively in a PriorityClass name string.

Transit mounts a TLS key pair into a gateway Pod from cluster-managed confidential data. Which approach matches common CKA practice?

Short Explanation

Full Explanation