How can you mount a Secret as files inside a container?

• A. Create a Secret, reference it as a volume of type secret, and mount it to a path in the container.
• B. Create a Secret and mount it as a ConfigMap volume.
• C. Use oc apply -f to mount automatically.
• D. Mount with a Route to the secret.

Answer: (A)

Mounting a Secret as files inside a container uses the secret volume type. You create the Secret resource and then declare a volume of type secret that references that Secret, and mount that volume into the container at a chosen path. Each key in the Secret becomes a file within that path—the file name is the secret key and the file contents are the decoded value of that key. You can set file permissions with defaultMode to control access.

This is the intended way to surface secret data as files at runtime because it leverages the secret volume mechanism designed for securely exposing Secret data. Other options aren’t appropriate for this purpose: mounting as a ConfigMap volume is for non-secret config data, Routes are for exposing services, and oc apply -f is a tool for applying manifests rather than a mounting method.