apiVersion: v1
kind: Pod
metadata:
  name: webapp-pod
spec:
  containers:
  - name: webapp-ctr
    image: httpd:2.4.47
    ports:
    - containerPort: 80
    volumeMounts:
    - mountPath: "/etc/webapp"
      name: webapp-secret-vol
      readOnly: true
  volumes:
  - name: webapp-secret-vol
    secret: 
      secretName: webapp-secret
      defaultMode: 0600 # if you don't specify it, 0644 will be used.
      items:
      - key: username
        path: username
      - key: password
        path: secure/password
        mode: 0400 #overriding defaultMode