It's mounted under `spicedb-db-tls` (which will need to be referenced in the `datastore_uri` in the secret), but this is not documented well.