<p>I have my deployment.yaml file within the templates directory of Helm charts with several environment variables for the container I will be running using Helm.</p>

<p>Now I want to be able to pull the environment variables locally from whatever machine the helm is ran so I can hide the secrets that way.</p>

<p>How do I pass this in and have helm grab the environment variables locally when I use Helm to run the application?</p>

<p>Here is some part of my deployment.yaml file</p>

<pre><code>...
...
    spec:
      restartPolicy: Always
      containers:
        - name: sample-app
          image: "sample-app:latest"
          imagePullPolicy: Always
          env:          
            - name: "USERNAME"
              value: "app-username"
            - name: "PASSWORD"
              value: "28sin47dsk9ik"
...
...
</code></pre>

<p>How can I pull the value of USERNAME and PASSWORD from local environment variables when I run helm?</p>

<p>Is this possible? If yes, then how do I do this?</p>

<p>You can <code>export</code> the variable and use it while running <code>helm install</code>.</p>

<p>Before that, you have to modify your chart so that the value can be <code>set</code> while installation. </p>

<p>Skip this part, if you already know, how to setup template fields.</p>

<hr>

<p>As you don't want to expose the data, so it's better to have it saved as secret in kubernetes. </p>

<p>First of all, add this two lines in your <code>Values</code> file, so that these two values can be set from outside.</p>

<pre><code>username: root
password: password
</code></pre>

<p>Now, add a <code>secret.yaml</code> file inside your <code>template</code> folder. and, copy this code snippet into that file. </p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: {{ .Release.Name }}-auth
data:
  password: {{ .Values.password | b64enc }}
  username: {{ .Values.username | b64enc }}
</code></pre>

<p>Now tweak your deployment yaml template and make changes in <code>env</code> section, like this</p>

<pre><code>...
...
    spec:
      restartPolicy: Always
      containers:
        - name: sample-app
          image: "sample-app:latest"
          imagePullPolicy: Always
          env:          
          - name: "USERNAME"
            valueFrom:
              secretKeyRef:
                key:  username
                name: {{ .Release.Name }}-auth
          - name: "PASSWORD"
            valueFrom:
              secretKeyRef:
                key:  password
                name: {{ .Release.Name }}-auth
...
...
</code></pre>

<hr>

<p>If you have modified your template correctly for <code>--set</code> flag,
you can set this using environment variable.</p>

<pre><code>$ export USERNAME=root-user
</code></pre>

<p>Now use this variable while running helm install,</p>

<pre><code>$ helm install --set username=$USERNAME ./mychart
</code></pre>

<p>If you run this <code>helm install</code> in <code>dry-run</code> mode, you can verify the changes,</p>

<pre><code>$ helm install --dry-run --set username=$USERNAME --debug ./mychart
[debug] Created tunnel using local port: '44937'

[debug] SERVER: "127.0.0.1:44937"

[debug] Original chart version: ""
[debug] CHART PATH: /home/maruf/go/src/github.com/the-redback/kubernetes-yaml-drafts/helm-charts/mychart

NAME:   irreverant-meerkat
REVISION: 1
RELEASED: Fri Apr 20 03:29:11 2018
CHART: mychart-0.1.0
USER-SUPPLIED VALUES:
username: root-user

COMPUTED VALUES:
password: password
username: root-user

HOOKS:
MANIFEST:

---
# Source: mychart/templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: irreverant-meerkat-auth
data:
  password: password
  username: root-user
---
# Source: mychart/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: irreverant-meerkat
  labels:
    app: irreverant-meerkat
spec:
  replicas: 1
  template:
    metadata:
      name: irreverant-meerkat
      labels:
        app: irreverant-meerkat
    spec:
      containers:
      - name: irreverant-meerkat
        image: alpine
        env:
        - name: "USERNAME"
          valueFrom:
            secretKeyRef:
              key:  username
              name: irreverant-meerkat-auth
        - name: "PASSWORD"
          valueFrom:
            secretKeyRef:
              key:  password
              name: irreverant-meerkat-auth

        imagePullPolicy: IfNotPresent
      restartPolicy: Always
  selector:
    matchLabels:
      app: irreverant-meerkat
</code></pre>

<p>You can see that the data of username in secret has changed to <code>root-user</code>.</p>

<p>I have added <a href="https://github.com/the-redback/kubernetes-yaml-drafts/tree/master/helm-charts/mychart" rel="noreferrer">this example</a> into github repo.</p>

<p>There is also some discussion in <a href="https://github.com/kubernetes/helm" rel="noreferrer">kubernetes/helm</a> repo regarding this. You can see <a href="https://github.com/kubernetes/helm/issues/944" rel="noreferrer">this issue</a> to know about all other ways to use environment variables.</p>
