CKS Minimize Microservice Vulnerabilities Practice Question
A pod uses a Secret mounted as a volume. The Secret is updated. How can the pod consume the updated values without restarting?
⚠ Common exam trap
Candidates often think that updating a Secret requires a pod restart, but in Kubernetes, Secrets mounted as volumes are automatically updated by the kubelet without restart.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The mounted volume is automatically updated over time
When a Secret is mounted as a volume in Kubernetes, the kubelet periodically syncs the secret data from the API server and updates the files in the volume. This means the pod can consume the updated values without needing a restart, as the files are refreshed automatically (with a default sync period of around 60 seconds). Option C correctly identifies this behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a sidecar container that watches for changes and reloads the application
Why it's wrong here
A sidecar container that watches for Secret changes and reloads the application does not solve the problem because Kubernetes updates the inotify-watched files in the volume mount automatically, yet the application itself must be designed to re-read those files from disk without a restart. The sidecar approach is tempting because it is a common pattern for legacy applications that lack native file-watching capabilities, and it would be correct if the application required a signal or a configuration reload triggered by an external process rather than relying on the kernel’s inotify mechanism.
- ✗
Update the pod spec to reference a new Secret version
Why it's wrong here
Kubernetes does not provide versioning for Secret objects; a Pod spec references a Secret by name, and that name resolves to a single live object. If you want to use a different version of a Secret, you would need to create a new Secret with a new name and update the Pod's volumeSource or env references accordingly. Unless you are willing to perform a coordinated rollout that changes the Secret name everywhere, this option fails to solve the problem and introduces unnecessary operational complexity.
- ✓
The mounted volume is automatically updated over time
Why this is correct
For a Secret mounted as a regular volume (not via subPath or as a projected volume), the kubelet periodically syncs the Secret from the API server to the volume directory, so the file contents are updated automatically. This triggers inotify events that a well-designed application can watch to reload configuration without restarting the Pod. The update is eventually consistent and typically occurs within a minute, but the application must be coded to re-read the file from disk after receiving a change notification.
- ✗
Delete and recreate the pod
Why it's wrong here
Deleting and recreating the Pod forcibly restarts the application, which is exactly what the question is trying to avoid. While a new Pod would fetch the latest Secret from the API server at creation, the old Pod remains unaffected until it is terminated, causing downtime and a manual intervention. Furthermore, if the Pod is managed by a controller such as a Deployment, deleting the Pod will trigger a new rollout, but this still does not provide continuous, automatic updates as the volume mount mechanism does.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.