<p>Trying to create a few <code>Airflow</code> connections and executing the command in <code>entrypoint.sh</code> file which is passed as entrypoint file in the <code>dockerfile</code>.
As these database credentials are very sensitive, is it possible that we store them securely in <code>kubernetes</code> or any other place on <code>GCP</code> and based on the <code>local</code>, <code>staging</code> or <code>production</code> we' populate them in the <code>entrypoint.sh</code>?</p>

<p>You can store them as kubernetes secret and mount them as an environment variable that will be accessible by entrypoint.sh</p>

<p>Remember kubernetes secret just encode secret as base64 otherwise you can use <a href="https://github.com/bitnami-labs/sealed-secrets" rel="nofollow noreferrer">sealed secrets</a>.</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: mycontainer
    image: redis
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username
      - name: SECRET_PASSWORD
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: password
  restartPolicy: Never

</code></pre>
