<p>Using Kubernetes 1.19.3, I initialize env variable values using 3 different ways:</p>
<ul>
<li><code>env</code> field with explicit key/value in the pod definition</li>
<li><code>envFrom</code> using <code>configMapRef</code> and <code>secretRef</code></li>
</ul>
<p>When a key name is duplicated, as shown in the example below, <code>DUPLIK1</code> and <code>DUPLIK2</code> are defined multiple times with different values.</p>
<p>What is the precedence rule that Kubernetes uses to assign the final value to the variable?</p>
<pre class="lang-sh prettyprint-override"><code># create some test Key/Value configs and Key/Value secrets
kubectl create configmap myconfigmap --from-literal=DUPLIK1=myConfig1 --from-literal=CMKEY1=CMval1 --from-literal=DUPLIK2=FromConfigMap -n mydebugns

kubectl create secret generic mysecret --from-literal=SECRETKEY1=SECval1 --from-literal=SECRETKEY2=SECval2 --from-literal=DUPLIK2=FromSecret -n mydebugns

# create a test pod
cat &lt;&lt;EOF | kubectl apply -n mydebugns -f -
apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: container1
      image: busybox
      command: [ &quot;/bin/sh&quot;, &quot;-c&quot;, &quot;env&quot; ]
      env:
      - name: DUPLIK1
        value: &quot;Key/Value defined in field env&quot;
      envFrom:
      - configMapRef:
          name: myconfigmap
      - secretRef:
          name: mysecret          
  restartPolicy: Never
EOF
</code></pre>
<p>Show environement variables values. The result is deterministic. Deleting resources + recreate always end up with the same result.</p>
<pre class="lang-sh prettyprint-override"><code>kubectl logs pod/pod1 -n mydebugns

CMKEY1=CMval1
DUPLIK1=Key/Value defined in field env
DUPLIK2=FromSecret
SECRETKEY1=SECval1
SECRETKEY2=SECval2
</code></pre>
<p>Cleanup test resources</p>
<pre class="lang-sh prettyprint-override"><code>kubectl delete pod/pod1 -n mydebugns
kubectl delete cm/myconfigmap  -n mydebugns
kubectl delete secret/mysecret -n mydebugns
</code></pre>

<p>From Kubernetes <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#container-v1-core" rel="noreferrer">docs</a>:</p>
<blockquote>
<p><code>envVar</code>: List of environment variables to set in the container.
Cannot be updated.</p>
</blockquote>
<blockquote>
<p><code>envFrom</code>: List of sources to populate environment variables in the
container. The keys defined within a source must be a C_IDENTIFIER.
All invalid keys will be reported as an event when the container is
starting. When a key exists in multiple sources, the value associated
with the last source will take precedence. <strong>Values defined by an Env
with a duplicate key will take precedence. Cannot be updated.</strong></p>
</blockquote>
<p>The above link clearly states the <code>env</code> will take precedence over <code>envFrom</code> and cannot be updated.</p>
<p>Also, when a referenced key is present in multiple resources, the value associated with the last source will override all previous values.</p>
<p>Based on the above, the result you are seeing is expected behavior:</p>
<ol>
<li><code>DUPLIK1</code> is added as <code>env</code> field and thus cannot be updated</li>
<li><code>DUPLIK2</code> is added as <code>envFrom</code> and so the one from the secret takes precedence as it is defined at the last</li>
</ol>
