Vaults secrets injected by vault sidecar container inside the pod are visible to kubernetes cluster users/admin

[stuart-c]

Environment variables are no better. Someone with permissions (e.g. a cluster admin) could easily exec into a pod and view all environment variables and their contents. If anything files are better than env vars.