check secret source exists, as bind mount would create target#12151