<p>I have the following command.</p>
<pre><code>oc new-build gen-dev/genbuilder:latest~ssh://git@mycompany.net:7999/gen/pfs-converter.git#DEV1 \
  --source-secret='privatekey' \
  --name='testbuild' \
  --env=KEY=VALUE
</code></pre>
<p>I would like to set the environment variables to have some secret values because the build will fail without them and I need to do it before this command takes places because new build immediately builds a new container.</p>

<h1>Adding from the Pod Defintion</h1>
<p>You can create environment variables by referencing the secret in the environment definition like this:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: secret-example-pod
spec:
  containers:
    - name: secret-test-container
      image: busybox
      command: [ &quot;/bin/sh&quot;, &quot;-c&quot;, &quot;export&quot; ]
      env:
        - name: TEST_SECRET_USERNAME_ENV_VAR
          valueFrom:
            secretKeyRef:
              name: test-secret
              key: username
  restartPolicy: Never
</code></pre>
<p>Here's the <a href="https://docs.openshift.com/container-platform/3.9/dev_guide/secrets.html" rel="nofollow noreferrer">documentation</a>.</p>
<hr />
<h1>Adding a Secret From the Command Line</h1>
<p>If you need to do everything from the command line, you can use JSONPath to get the values from the secret you want like this:</p>
<pre><code>oc new-build gen-dev/genbuilder:latest~ssh://git@mycompany.net:7999/gen/pfs-converter.git#DEV1 \
  --source-secret='privatekey' \
  --name='testbuild' \
  -e PRIVATE_KEY=$(oc get secret &lt;your secret&gt; -o jsonpath='{&lt;path to field&gt;}')
</code></pre>
<h2>Explanation</h2>
<p>This will add PRIVATE_KEY to the environment of the container when it is built, and will be available to applications when it starts.</p>
<p>The $() around the OC command to get the secret will evaluate the command inside, then place its output there.</p>
<p>The <code>-o</code> flag tells the OC CLI how to provide the output, so if you only wanted the names of builds for example, you would run:</p>
<pre><code>oc get builds -o name
</code></pre>
<p><a href="https://www.mankier.com/1/oc-get#--output" rel="nofollow noreferrer">Here</a> are the output options supported.</p>
<h2>Example</h2>
<p>You'll need to provide the JSONPath to the field you want pulled from the secret. For example, to get the password field from this secret:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: test-secret
  namespace: my-namespace
type: Opaque 
data: 
  username: dmFsdWUtMQ0K 
  password: dmFsdWUtMg0KDQo=
stringData: 
  hostname: myapp.mydomain.com 
</code></pre>
<p>You would run:</p>
<pre><code>oc new-build gen-dev/genbuilder:latest~ssh://git@mycompany.net:7999/gen/pfs-converter.git#DEV1 \
  --source-secret='privatekey' \
  --name='testbuild' \
  -e PASSWORD=$(oc get secret test-secret -o jsonpath='{.data.password}')
</code></pre>
<p>This is the same as adding <code>-e PASSWORD='dmFsdWUtMg0KDQo='</code> to your command, and applications in the container will be able to access that variable from the environment of the container.</p>
<p>Here's the <a href="https://kubernetes.io/docs/reference/kubectl/jsonpath/" rel="nofollow noreferrer">documentation</a> for using JSONPath, and an <a href="https://jsonpath.com/" rel="nofollow noreferrer">evaluator</a> if you have trouble getting the path right.</p>
<h1>Adding a Build Secret</h1>
<p>You can also add a secret to the build environment without exposing it to the environment using the <code>--build-secret</code> flag.</p>
<p>Command:</p>
<pre><code>oc new-build \
openshift/nodejs-010-centos7~https://github.com/sclorg/nodejs-ex.git \
--build-secret “secret-npmrc:/etc”
</code></pre>
<p>This adds the secret to a directory in the build environment, in this case the .npmrc file is added to /etc.</p>
<p>I don't think it's generally good practice to add secrets to the environment, and you may want to look into changing up your setup to avoid this. In the past, I've always added secrets to template definitions, but it looks like you're letting Openshift create the templates for you.</p>
