> at that point it's still sitting there mounted and they can read the file? Yes, if someone has exec access into your container, they'll be able to see the se

> at that point it's still sitting there mounted and they can read the file? Yes, if someone has exec access into your container, they'll be able to see the secret, unless you do something like making the K8s secret an already encrypted blob, and then in process decrypting it again and reading it. If someone's got exec access to your container though, you've got bigger problems. > Or do we just accept that you have to treat anyone with access to kubectl as authorised to know your private cert ? You can set up access so that someone can login with Kubectl but still only be readonly, and you can preclude read ("get") access to secrets to the readonly role, so they won't be able to view the contents of the secret.