Init Container Secret Mount Path Resolver

Threat/Impact Level: HIGH | Downtime Risk: HIGH | Time to Fix: 10–20 mins

TL;DR

• What broke: The init container exited with code 1 because volumeMounts[].mountPath: /etc/secrets references a volume that is either not declared under spec.volumes, has a mismatched name, or points to a non-existent Secret object in the namespace.
• How to fix it: Align the volumes[].name → volumeMounts[].name chain, confirm the secretName exists in the same namespace, and verify the init container has read access via RBAC.
• Shortcut: Use our Client-Side Sandbox above to auto-refactor this — paste your pod spec and get corrected YAML without sending secrets to any external server.

Init Containers:
  init-secret-loader:
    State: Terminated
      Reason: Error
      Exit Code: 1
    Message: "/etc/secrets: no such file or directory"

Events:
  Warning  Failed  kubelet  Error: failed to create containerd task: 
           failed to create shim: OCI runtime create failed: 
           container_linux.go:380: starting container process caused: 
           process_linux.go:545: container init caused: 
           rootfs_linux.go:76: mounting "/etc/secrets" ...: 
           mount /etc/secrets: no such file or directory

How to Fix It (The Solution)

Root Cause Checklist (run these first)

# 1. Does the Secret exist in the correct namespace?
kubectl get secret <secret-name> -n <namespace>

# 2. What does the pod spec actually declare for volumes?
kubectl get pod <pod-name> -n <namespace> -o jsonpath='{.spec.volumes}'

# 3. What does the init container declare for volumeMounts?
kubectl get pod <pod-name> -n <namespace> -o jsonpath='{.spec.initContainers[0].volumeMounts}'

Basic Fix: Align Volume Name and secretName

The most common cause is a name mismatch between spec.volumes[].name and initContainers[].volumeMounts[].name, or a wrong secretName.

 spec:
   initContainers:
     - name: init-secret-loader
       image: busybox:1.36
       volumeMounts:
-        - name: app-secrets-vol
+        - name: secret-volume
           mountPath: /etc/secrets
           readOnly: true
   containers:
     - name: app
       image: my-app:latest
       volumeMounts:
-        - name: app-secrets-vol
+        - name: secret-volume
           mountPath: /etc/secrets
           readOnly: true
   volumes:
-    - name: app-secrets-vol
-      secret:
-        secretName: my-app-config   # <-- this Secret does not exist
+    - name: secret-volume
+      secret:
+        secretName: my-app-secrets  # <-- verified: kubectl get secret my-app-secrets -n <ns>
+        defaultMode: 0400           # owner read-only; never 0777

Enterprise Best Practice: Projected Volumes + RBAC + Optional Secret Handling

In production, you should never hard-fail pod startup because a secret doesn't exist yet (common in Vault dynamic secrets, Sealed Secrets, or External Secrets Operator flows). Use optional: true for non-critical secrets, and projected volumes to merge multiple sources.

 spec:
   serviceAccountName: app-sa  # bind only the RBAC needed
   initContainers:
     - name: init-secret-loader
       image: busybox:1.36
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
       volumeMounts:
-        - name: raw-secret
-          mountPath: /etc/secrets
+        - name: projected-secrets
+          mountPath: /etc/secrets
+          readOnly: true
   volumes:
-    - name: raw-secret
-      secret:
-        secretName: my-app-secrets
+    - name: projected-secrets
+      projected:
+        defaultMode: 0400
+        sources:
+          - secret:
+              name: my-app-secrets
+              optional: false   # hard dependency — fail fast if missing
+          - secret:
+              name: my-app-tls-secrets
+              optional: true    # soft dependency — pod starts without it
+          - serviceAccountToken:
+              path: token
+              expirationSeconds: 3600
+              audience: vault

RBAC: ensure the pod's ServiceAccount cannot read secrets it doesn't own:

# Least-privilege Role — scoped to specific secret names, not wildcard
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-secret-reader
  namespace: production
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["my-app-secrets"]  # never omit resourceNames
    verbs: ["get"]

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# policy/secret-volume-mount.rego
package kubernetes.secret_mount

deny[msg] {
  container := input.spec.initContainers[_]
  mount := container.volumeMounts[_]
  mount.mountPath == "/etc/secrets"
  not volume_exists(mount.name)
  msg := sprintf("Init container '%v' mounts volume '%v' at /etc/secrets but no matching volume is declared in spec.volumes", [container.name, mount.name])
}

volume_exists(name) {
  input.spec.volumes[_].name == name
}

# .github/workflows/k8s-lint.yml
- name: Checkov Kubernetes Scan
  uses: bridgecrewio/checkov-action@master
  with:
    directory: k8s/
    framework: kubernetes
    check: CKV_K8S_35,CKV_K8S_28,CKV_K8S_30
    # CKV_K8S_35: secrets as env vars (blocks the bad workaround)
    # CKV_K8S_28: readOnlyRootFilesystem
    # CKV_K8S_30: runAsNonRoot

#!/bin/bash
# scripts/verify-secrets.sh — run before helm upgrade or kubectl apply
set -euo pipefail

REQUIRED_SECRETS=("my-app-secrets" "my-app-tls-secrets")
NAMESPACE="production"

for secret in "${REQUIRED_SECRETS[@]}"; do
  if ! kubectl get secret "$secret" -n "$NAMESPACE" &>/dev/null; then
    echo "[FATAL] Secret '$secret' not found in namespace '$NAMESPACE'. Aborting deploy."
    exit 1
  fi
done
echo "[OK] All required secrets verified."