<p>I have a template and a deployment in it, One of my deployment's env variables is a value from a secret that contains the name of the namespace that just used the template.
The secret must contain the name of the namespace, I can't change it.</p>
<p>I know that it is possible to use env variables as value of different env variables. Looks like this:</p>
<pre><code>env:
  - name: MY_NAMESPACE
    valueFrom:
      fieldRef:
        apiVersion: v1
        fieldPath: metadata.namespace
  - name: FULL_NAME
    value: ${MY_NAME}.$(MY_NAMESPACE)
</code></pre>
<p>This way, if my namespace's name is <strong>app</strong> and the <strong>MY_NAME</strong> parameter is <strong>dan</strong>:</p>
<pre><code>echo $FULL_NAME
&gt; dan.app
</code></pre>
<p>But I want to use that name as a reference to a secret name. Like this:</p>
<pre><code>env:
  - name: MY_NAMESPACE
    valueFrom:
      fieldRef:
        apiVersion: v1
        fieldPath: metadata.namespace
  - name: FULL_NAME_SECRET
    valueFrom:
      secretKeyRef:
        name: ${MY_NAME}.$(MY_NAMESPACE)
        key: app_name
</code></pre>
<p>I get an event that says:</p>
<blockquote>
<p>Pod &quot;test-0&quot; is invalid[spec.containers[0].env[1].valueFrom.secretKeyRef.name: Invalid value: &quot;dan.$(MY_NAMESPACE)&quot;: a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start with an alphanumeric character</p>
</blockquote>
<p>Well basically it does not translate the $(MY_NAMESPACE) to the actual value of its env variable.</p>

<p>The <code>secretKeyRef:</code> secret name must be a fixed string.  Variable expansion only happens in a couple of places in the pod spec (in <code>env:</code> values, <code>command:</code>, and <code>args:</code>, but nowhere else).</p>
<p>For your immediate problem, it may help to recognize that a Pod and any matching Secret <em>must</em> be in the same namespace.  You don't need to include the namespace name in the Secret name, and there's no way to refer to a Secret in a different namespace if you needed to.</p>
<pre class="lang-yaml prettyprint-override"><code>- name: FULL_NAME_SECRET
  valueFrom:
    secretKeyRef:
      name: dan       # always in the same namespace
      key: app_name
</code></pre>
<p>More broadly, you can use a tool like <a href="https://helm.sh" rel="nofollow noreferrer">Helm</a> to fill in some of these values from templates.  These can use data known at install time to construct &quot;fixed strings&quot; that can be submitted to Kubernetes.</p>
<pre class="lang-yaml prettyprint-override"><code>{{/* In a Helm chart's templates/deployment.yaml */}}
- name: FULL_NAME_SECRET
  valueFrom:
    secretKeyRef:
      name: {{ include &quot;dan.name&quot; . }}.{{ .Release.Namespace }}
      key: app_name
</code></pre>
<p>In this the parts in the curly braces <code>{{ ... }}</code> are expanded by Helm's template engine.  <code>.Release.Namespace</code> is the namespace into which you're installing.  <code>include &quot;dan.name&quot; .</code> calls a helper template that constructs the &quot;dan&quot; name, in a way that supports multiple installations in the same namespace.</p>
