Which method can be used to inject secrets into a container's environment?

• A. Mounting as a volume is the only supported method.
• B. Secrets can be injected only as environment variables.
• C. Using envFrom with secretRef or using environment variable mapping from a secret key (secretKeyRef) populates container vars.
• D. Secrets cannot be consumed by Pods.

Answer: (C)

Injecting secrets into a container’s environment is done by wiring a Secret into the Pod so its values appear as environment variables. You can pull secrets into the environment in two flexible ways: using envFrom with secretRef, which creates an environment variable for every key in the secret, and using a specific environment variable that maps to a secret key via secretKeyRef, which lets you pick one key and assign it to a chosen variable name. This keeps sensitive data accessible to the container at startup without baking it into images or configurations. Mounting the secret as a volume would expose the data as files inside the container, not as environment variables, so it doesn’t fulfill the environment-injection aspect.