<p>I have a kubernetes yaml deployment file which accepts db username and password as arguments as shown below. </p>

<pre><code>args:
        - "-db_host=postgres"
        - "-db_port=5432"
        - "-db_username=postgres"
        - "-db_password=postgres"
</code></pre>

<p>To hide the values of db_username and db_password I thought of using kubernetes secret kind. But to achieve that I have to make db_username and db_password as environment variables so that I can use it something like as shown below:</p>

<pre><code>args:
        - "-db_host=postgres"
        - "-db_port=5432"
env:
        - name: db_username
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-user
        - name: db_password
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-pass
</code></pre>

<p>Is there any way we can use secret in args itself so that I don't have to do the 2nd approach. </p>

<p>Once you have an environment variable you can embed its value into the arguments:</p>

<pre><code>env:
- name: MESSAGE
  value: "hello world"
command: ["/bin/echo"]
args: ["$(MESSAGE)"]
</code></pre>

<p>Or in your case:</p>

<pre><code>args:
        - "-db_host=postgres"
        - "-db_port=5432"
        - "-db_username=$(db_username)"
        - "-db_password=$(db_password)"
env:
        - name: db_username
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-user
        - name: db_password
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: db-pass
</code></pre>

<p>The reference can be found <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/" rel="noreferrer">here</a></p>
