<p>Variable substitution in Gitlab only seem to work inside the <code>gitlab-ci.yml</code> file.</p>
<p>However I have a configuration file (k8s secret) where I would like to set different values depending if I'm in a staging or a production environment.</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: tls-config
  namespace: myNamespace
type: kubernetes.io/tls
data:
  tls.crt: |
    ${TLS_CRT}

  tls.key: |
    ${TLS_KEY}
</code></pre>
<p>Where <strong>TLS_CRT</strong> &amp; <strong>TLS_KEY</strong> would be variables defined in /settings/ci_cd/variables.</p>
<p>How should one handle variable substitution in this case?</p>

<p>You could use an editor like <code>sed</code></p>
<p>For example, if you had the file like:</p>
<pre class="lang-yaml prettyprint-override"><code>data:
  tls.crt: |
    #TLS_CRT#

  tls.key: |
    #TLS_KEY#
</code></pre>
<p>You could use <code>sed</code> like this as part of your GitLab job to replace its contents:</p>
<pre class="lang-yaml prettyprint-override"><code>myjob:
  script:
  - sed -i &quot;s|#TLS_CRT#|${TLS_CRT}|&quot; ./path/to/file
  - sed -i &quot;s|#TLS_KEY#|${TLS_KEY}|&quot; ./path/to/file
</code></pre>
<p>Then the file contents will be something like this:</p>
<pre><code>data:
  tls.crt: |
        MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
  tls.key: |
        MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
</code></pre>
<p>Using the pattern <code>#word#</code> is not totally necessary. However, it does make using the <code>sed</code> easier, as it avoids needing to escape the literal <code>${}</code> characters in the shell command.</p>
<p>As a short explanation of the sed command used here:</p>
<pre><code>#    v shorthand for --in-place; edits the file directly
sed -i &quot;s|FIRST_ARGUMENT|SECOND_ARGUMENT|&quot; ./path/to/file
#         ^ replace this ^ with this       ^ in this file
</code></pre>
<p>Fore more info, see here: <a href="https://unix.stackexchange.com/a/112024/453397">https://unix.stackexchange.com/a/112024/453397</a></p>
