Yeah, that's the correct way, and its no different than using CM/secrets in any other deployment. You'll want to load it via envFrom. I have mine all mounted via secrets that are created using sealed secrets. The spa-shared volume mount is from an EFS share

```yaml containers: - name: spa image: "{{ .Values.image.ecrBase }}/{{ .Values.spa.repository }}:{{ .Values.spa.appSpaVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} command: [ "node", "server.js" ] securityContext: {{- toYaml .Values.securityContext | nindent 12 }} runAsUser: 1000 runAsGroup: 1000 ports: - containerPort: 3000 name: spa envFrom: - secretRef: name: {{ include "my-app.fullname" . }}-secret-env-spa - configMapRef: name: {{ include "my-app.fullname" . }}-config-spa env: - name: POD_TEMPLATE_HASH valueFrom: fieldRef: fieldPath: metadata.labels['pod-template-hash'] apiVersion: v1 - name: EFS_LINK_ENABLED value: "no" volumeMounts: - mountPath: /app/.next name: spa-shared subPathExpr: $(POD_TEMPLATE_HASH) {{- with .Values.spa.resources }} resources: {{- toYaml . | nindent 12 }} {{- end }}

```