How can you inject environment variables into a container from a Secret?

• A. Env vars cannot be sourced from secrets.
• B. Use envFrom: secretRef or environment variables from keyRef mapping.
• C. Only by editing the image to include the variables.
• D. Secrets must be mounted as volumes, not environment variables.

Answer: (B)

Injecting environment variables from a Secret is done by referencing that Secret in the container spec. You have two common patterns. First, you can import all keys from the Secret as environment variables using envFrom: secretRef, which creates an environment variable for every key in the Secret with the same name. Second, you can map a specific Secret key to a single environment variable with a valueFrom: secretKeyRef entry, specifying the Secret name and the key you want to expose. This lets you keep sensitive data out of the image and manage it securely in the cluster.

Other ideas like not sourcing from Secrets, editing the image to include the values, or mounting Secrets only as volumes don’t describe how to populate environment variables directly. You can indeed feed env vars from Secrets using these approaches.