<p>I have two <code>ConfigMap</code> files. One is supposed to be &quot;secret&quot; values and the other has regular values and should import the secrets.</p>
<p>Here's the sample secret <code>ConfigMap</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ConfigMap
metadata:
  name: secret-cm
data:
  MY_SEKRET: 'SEKRET'
</code></pre>
<p>And the regular <code>ConfigMap</code> file:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ConfigMap
metadata:
  name: regular-cm
data:
  SOME_CONFIG: 123
  USING_SEKRET: $(MY_SEKRET)
</code></pre>
<p>And my deployment is as follows:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: my_container
          envFrom:
            - configMapRef:
                name: secret-cm
            - configMapRef:
                name: regular-cm
</code></pre>
<p>I was hoping that my variable <code>USING_SEKRET</code> would be <code>&quot;SEKRET&quot;</code> because of the order the <code>envFrom</code> files are imported but they just appear as <code>&quot;$(MY_SEKRET)&quot;</code> on the Pods.</p>
<p>I've also tried setting the dependent variable as an <code>env</code> directly at the Deployment but it results on the same problem:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: Deployment
...
  env:
    - name: MY_SEKRET
      # Not the expected result because the variable is openly visible but should be hidden
      value: 'SEKRET'
</code></pre>
<p>I was trying to follow the documentation guides, based on the <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/#define-an-environment-dependent-variable-for-a-container" rel="nofollow noreferrer">Define an environment dependent variable for a container</a> but I haven't seen examples similar to what I want to do.</p>
<p>Is there a way to do this?</p>
<p>EDIT:
To explain my idea behind this structure, <code>secret-cm</code> whole file will be encrypted at the repository so not all peers will be able to see its contents.
On the other hand, I still want to be able to show everyone where its variables are used, hence the dependency on <code>regular-cm</code>.
With that, authorized peers can run <code>kubectl</code> commands and variable replacements of <code>secret-cm</code> would work properly but for everyone else the file is hidden.</p>

<p>You did not explain why you want to define two configmap (one getting value from another) but I am assuming that you want the env parameter name define in confgimap be independent of paramter name used by your container in pod. If that is the case then create your configmap
<code>kind: ConfigMap metadata: name: secret-cm data: MY_SEKRET: 'SEKRET'</code></p>
<p>Then in your deployment use the env variable from configmap</p>
<pre><code>kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: my_container
          env:
            - name: USING_SEKRET
              valueFrom:
                configMapKeyRef:
                  name: secret-cm
                  key: MY_SEKRET 
</code></pre>
<p>Now when you access env variable $USING_SEKRET, it will show value as 'SEKRET'</p>
<p>incase your requirement is different then ignore this response and provide more details.</p>
