Sometimes hyper-specific technical musings Zola 2026-07-16T00:00:00+00:00 https://blog.alwyn.io/tags/certificates/atom.xml 2026-07-16T00:00:00+00:00 2026-07-16T00:00:00+00:00 alveel https://blog.alwyn.io/blog/kubernetes-secret-mounts/ <p>Useful one-liner to find all workloads that mount a specific secret:</p> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="plain"><span class="giallo-l"><span>export secret_name=foo kubectl get deploy,statefulset,daemonset,job,cronjob -A -o json | jq -r --arg s $secret_name &#39;.items[] | select([.. | objects | .secretName?, .secretKeyRef?.name, .secretRef?.name, .secret?.name] | any(. == $s)) | &quot;\(.metadata.namespace) \(.kind)/\(.metadata.name)&quot;&#39;</span></span></code></pre> <p>This recursively searches for all <code>secretName</code>, <code>secretKeyRef</code>, <code>secretRef</code> and <code>secret</code> keys, taking into account all forms of referencing a secret (<code>(deploy|sts|ds,job).spec.(job)template</code> assumed):</p> <ul> <li><code>.spec.volumes.secret.secretName</code> - "classic" secret volume</li> <li><code>.spec.volumes.projected.sources.secret.name</code> - projected source</li> <li><code>.spec.containers.env.valueFrom.secretKeyRef.name</code> - for a specific environment variable</li> <li><code>.spec.containers.envFrom.secretRef.name</code> - for populating environment variables from a secret</li> </ul>