k8s/secret.yaml data[db.password] = czNjcjN0LWZyb20tazhz
  base64 -d  ->  s3cr3t-from-k8s     (encoding, not encryption: anyone with 'get secrets' can do this)
mounted directory, as the kubelet lays it out:
  ..2026_11_08_10_00_00.111111111/
  ..data -> ..2026_11_08_10_00_00.111111111
  db.password -> ..data/db.password
  db.username -> ..data/db.username
spring.config.import = configtree:<mount>/
bound: DbProperties[url=null, username=app, password=<redacted:15 chars>]
config tree property source: Config tree '<mount>'
keys it exposes: [db.password, db.username]
-> kubelet-style update: new generation dir, ..data link swapped atomically
environment after the swap:  db.password = s3cr3t-from-k8s
DbProperties after the swap: s3cr3t-from-k8s
@RefreshScope bean after swap: s3cr3t-from-k8s
ContextRefresher.refresh() changed keys: [db.password]
environment after refresh:   db.password = s3cr3t-rotated
@RefreshScope bean after refresh: s3cr3t-rotated
directory missing, import = configtree:/no/such/dir/:
  started: no; ConfigDataResourceNotFoundException: Config data resource 'config tree [/no/such/dir]' via location 'configtree:/no/such/dir/' cannot be found
directory missing, import = optional:configtree:/no/such/dir/:
  started: yes; db.password = null