<p>I am using Terraform to provision resources in Azure, one of which is a Postgres database. My Terraform module includes the following to generate a random password and output to console.</p>

<pre><code>resource "random_string" "db_master_pass" {
  length            = 40
  special           = true
  min_special       = 5
  override_special  = "!-_"
  keepers           = {
    pass_version  = 1
  }
}

# For postgres
output "db_master_pass" {
  value = "${module.postgres.db_master_pass}"
}
</code></pre>

<p>I am using Kubernetes deployment manifest to deploy the application to Azure managed Kubernetes service. Is there a way of passing the database password to Kubernetes in the deployment pipeline? I am using CircleCI for CICD. Currently, I'm copying the password, encoding it to base64 and pasting it to the secrets manifest before running the deployment.</p>

<p>One solution is to generate the Kubernetes yaml from a template.</p>

<p>The pattern uses <a href="https://www.terraform.io/docs/configuration/functions/templatefile.html" rel="nofollow noreferrer">templatefile</a> function in Terraform 0.12 or the <a href="https://www.terraform.io/docs/providers/template/index.html" rel="nofollow noreferrer">template</a> provider earlier versions to read and <a href="https://www.terraform.io/docs/providers/local/r/file.html" rel="nofollow noreferrer">local_file</a> resource to write. For example:</p>

<pre><code>data "template_file" "service_template" {
  template = "${file("${path.module}/templates/service.tpl")}"
  vars {
    postgres_password = ""${module.postgres.db_master_pass}"
  }
}

resource "local_file" "template" {
  content  = "${data.template_file.service_template.rendered}"
  filename = "postegres_service.yaml"
}
</code></pre>

<p>There are many other options, like using to the <a href="https://www.terraform.io/docs/providers/kubernetes/guides/getting-started.html" rel="nofollow noreferrer">Kubernetes</a> provider, but I think this better matches your question.</p>
