I'm not a fan of this approach. I think the Secrets Store CSI Driver (https://github.com/kubernetes-sigs/secrets-store-csi-driver) has a better approach. It mounts secrets directly from a KMS (e.g. Vault, AWS KMS, GCP KMS, Azure Key Vault) into your application's file system.
Why not environment variables? Because files have stronger access control mechanisms than environment variables. Someone in the same PID namespace as your process can see your environment variables, but they can't necessarily see your files.(Although the driver does support environment variables for compatibility: https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-e...)
Why not environment variables? Because files have stronger access control mechanisms than environment variables. Someone in the same PID namespace as your process can see your environment variables, but they can't necessarily see your files.(Although the driver does support environment variables for compatibility: https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-e...)