diff --git a/pkg/globalmanager/federatedlearningjob.go b/pkg/globalmanager/federatedlearningjob.go
index 74c242c2..2ee83b39 100644
--- a/pkg/globalmanager/federatedlearningjob.go
+++ b/pkg/globalmanager/federatedlearningjob.go
@@ -409,6 +409,13 @@ func (fc *FederatedController) createPod(job *sednav1.FederatedLearningJob) (act
 		return active, fmt.Errorf("failed to get model %s: %w",
 			modelName, err)
 	}
+
+	secretName := model.Spec.CredentialName
+	var modelSecret *v1.Secret
+	if secretName != "" {
+		modelSecret, _ = fc.kubeClient.CoreV1().Secrets(job.Namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
+	}
+
 	participantsCount := strconv.Itoa(len(job.Spec.TrainingWorkers))
 
 	// deliver pod for aggregation worker
@@ -432,8 +439,9 @@ func (fc *FederatedController) createPod(job *sednav1.FederatedLearningJob) (act
 	aggWorkerParam.mounts = append(aggWorkerParam.mounts,
 		WorkerMount{
 			URL: &MountURL{
-				URL:  model.Spec.URL,
-				Mode: workerMountWriteOnly,
+				URL:    model.Spec.URL,
+				Mode:   workerMountWriteOnly,
+				Secret: modelSecret,
 			},
 			EnvName: "MODEL_URL",
 		},
@@ -467,20 +475,28 @@ func (fc *FederatedController) createPod(job *sednav1.FederatedLearningJob) (act
 				datasetName, err)
 		}
 
+		secretName := dataset.Spec.CredentialName
+		var datasetSecret *v1.Secret
+		if secretName != "" {
+			datasetSecret, _ = fc.kubeClient.CoreV1().Secrets(job.Namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
+		}
+
 		// Configure container mounting and Env information by initial WorkerParam
 		var workerParam *WorkerParam = new(WorkerParam)
 
 		workerParam.mounts = append(workerParam.mounts,
 			WorkerMount{
 				URL: &MountURL{
-					URL: model.Spec.URL,
+					URL:    model.Spec.URL,
+					Secret: modelSecret,
 				},
 				EnvName: "MODEL_URL",
 			},
 
 			WorkerMount{
 				URL: &MountURL{
-					URL: dataset.Spec.URL,
+					URL:    dataset.Spec.URL,
+					Secret: datasetSecret,
 				},
 				EnvName: "TRAIN_DATASET_URL",
 			},
diff --git a/pkg/globalmanager/jointinferenceservice.go b/pkg/globalmanager/jointinferenceservice.go
index b7a90d98..7c1cc87f 100644
--- a/pkg/globalmanager/jointinferenceservice.go
+++ b/pkg/globalmanager/jointinferenceservice.go
@@ -434,8 +434,16 @@ func (jc *JointInferenceServiceController) createCloudWorker(service *sednav1.Jo
 
 	var workerParam WorkerParam
 
+	secretName := cloudModel.Spec.CredentialName
+	var modelSecret *v1.Secret
+	if secretName != "" {
+		modelSecret, _ = jc.kubeClient.CoreV1().Secrets(service.Namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
+	}
 	workerParam.mounts = append(workerParam.mounts, WorkerMount{
-		URL:     &MountURL{URL: cloudModel.Spec.URL},
+		URL: &MountURL{
+			URL:    cloudModel.Spec.URL,
+			Secret: modelSecret,
+		},
 		Name:    "model",
 		EnvName: "MODEL_URL",
 	})
@@ -468,6 +476,12 @@ func (jc *JointInferenceServiceController) createEdgeWorker(service *sednav1.Joi
 			edgeModelName, err)
 	}
 
+	secretName := edgeModel.Spec.CredentialName
+	var modelSecret *v1.Secret
+	if secretName != "" {
+		modelSecret, _ = jc.kubeClient.CoreV1().Secrets(service.Namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
+	}
+
 	// FIXME(llhuii): only the case that Spec.NodeName specified is support,
 	// will support Spec.NodeSelector.
 	// get bigModelIP from nodeName in cloudWorker
@@ -483,7 +497,10 @@ func (jc *JointInferenceServiceController) createEdgeWorker(service *sednav1.Joi
 	var workerParam WorkerParam
 
 	workerParam.mounts = append(workerParam.mounts, WorkerMount{
-		URL:     &MountURL{URL: edgeModel.Spec.URL},
+		URL: &MountURL{
+			URL:    edgeModel.Spec.URL,
+			Secret: modelSecret,
+		},
 		Name:    "model",
 		EnvName: "MODEL_URL",
 	})
diff --git a/pkg/globalmanager/types.go b/pkg/globalmanager/types.go
index 1b6f1162..58b8666f 100644
--- a/pkg/globalmanager/types.go
+++ b/pkg/globalmanager/types.go
@@ -54,8 +54,10 @@ type IncrementalCondData struct {
 
 		// the data samples reference will be stored into this URL.
 		// The content of this url would be:
-		// s3://dataset/ mnist/0.jpg
-		// s3://dataset/ mnist/1.jpg
+		// # the first uncomment line means the directory
+		// s3://dataset/
+		// mnist/0.jpg
+		// mnist/1.jpg
 		DataIndexURL string `json:"dataIndexURL,omitempty"`
 
 		OutputDir string `json:"outputDir,omitempty"`