Change:
This is a Bug Report <!-- Thanks for filing an issue! Before submitting, please fill in the following information. --<!-- See for guidance on writing an actionable issue description. --<!--Required Information--Problem: I saw an out-of-tree product mention that static pods "can not use" ConfigMaps and Secrets. I was unaware of such a prohibition. I went looking in the k8s website. I spent a lot of time not finding any mention of such a restriction. For example: mentions static pods but not the restriction; describes ConfigMap and Secret type volumes but does not mention the restriction; the Go sources for the relevant API types do not mention the restriction (). I eventually found the restriction wrt ConfigMap mentioned in , but I think it should not appear only there. Proposed Solution: Update either or both of the first two pages I cited that currently lack the restriction. Update the API types to mention the restriction. Page to Update: Listed above. <!--Optional Information (remove the comment tags around information you would like to include)--<!--Kubernetes Version:--<!--Additional Information:--
/triage accepted
I can work on this one. Thanks. /assign
I just realized there is an additional --- and more severe --- restriction on static pods. They can not have a ! As a corollary, they are not given a by default. For example, using a static pod: ... note that there is no ! is one place where this would be relevant.
The prohibition is even broader and simpler: the definition of a static pod can not refer to any other API object. For example, PersistentVolumeClaim is another thing that a static pod's definition can not reference.

Discussion:
in that Pod based on the data in the ConfigMap. The Pod and the ConfigMap must be in the same {{< glossary_tooltip text="namespace" term_id="namespace" >}}. <ins> {{< note >}} The `spec` of a {{< glossary_tooltip text="static Pod" term_id="static-pod" >}} cannot refer to a ConfigMap or any other API objects. {{< /note >}} </ins> Here's an example ConfigMap that has some keys with single values, and other keys where the value looks like a fragment of a configuration format.

This includes any Pods created using `kubectl`, or indirectly via a replication controller. It does not include Pods created as a result of the kubelet `--manifest-url` flag, its `--config` flag, or its REST API (these are <del> not common ways to create Pods.) </del> <ins> not common ways to create Pods). The `spec` of a {{< glossary_tooltip text="static Pod" term_id="static-pod" >}} cannot refer to a Secret or any other API objects. </ins> Secrets must be created before they are consumed in Pods as environment variables unless they are marked as optional. References to secrets that do

This means that the Pods running on a node are visible on the API server, but cannot be controlled from there. <ins> {{< note >}} The `spec` of a static Pod cannot refer to other API objects (e.g., {{< glossary_tooltip text="ServiceAccount" term_id="service-account" >}}, {{< glossary_tooltip text="ConfigMap" term_id="configmap" >}}, {{< glossary_tooltip text="Secret" term_id="secret" >}}, etc). {{< /note >}} </ins> ## Container probes A _probe_ is a diagnostic performed periodically by the kubelet on a container. To perform a diagnostic, the kubelet can invoke different actions:

instead. {{< /note >}} <ins> {{< note >}} The `spec` of a static Pod cannot refer to other API objects (e.g., {{< glossary_tooltip text="ServiceAccount" term_id="service-account" >}}, {{< glossary_tooltip text="ConfigMap" term_id="configmap" >}}, {{< glossary_tooltip text="Secret" term_id="secret" >}}, etc). {{< /note >}} </ins> ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}