Ultimately they must persist in memory to be useful. Beyond bootstrapping, sometimes API keys, etc must be read continuously. Env is as good a place as any if y

Ultimately they must persist in memory to be useful. Beyond bootstrapping, sometimes API keys, etc must be read continuously. Env is as good a place as any if you need it continuously. If you mount a tmpfs and copy it into the container env at runtime, is this much worse than mounting a secret object in the k8s Deployment/pod definition in api server? You could argue that the k8s API server wouldn’t learn it if it was runtime discovered, but this increases complexity. Are ephemeral secret mounts that much better than the built k8s secret objects? I would say no.