<p>When using Kubernetes <code>.yml</code> files, I can do the following:</p>
<pre class="lang-sh prettyprint-override"><code>$ cat configmap.yml

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-configmap
data:
  foo: ${FOO}
  bar: ${BAR}
  static: doesNotChange

$ export FOO=myFooVal
$ export BAR=myBarVal
$ cat configmap.yml | envsubst | kubectl apply -f -
</code></pre>
<p>This would replace <code>${FOO}</code> and <code>${BAR}</code> in the <code>configmap.yml</code> file before actually applying the file to the cluster.</p>
<p>How could I achieve the very same behavior with a Kubernetes secret which has it's data values base64 encoded?</p>
<p>I would need to read all the keys in the <code>data:</code> field, decode the values, apply the environment variables and encode it again.</p>
<p>A tool to decode and encode the <code>data:</code> values inplace would be much appreciated.</p>

<p>It is actually possible, to store the <code>secret.yml</code> with <code>stringData</code> instead of <code>data</code> which allows to keep the files in plain text (SOPS encryption is still possible and encouraged)</p>
<pre><code>$ cat secret.yml

apiVersion: v1
kind: Secret
metadata:
  name: test-secret
  namespace: default
type: Opaque
stringData:
  dotenv: |
    DATABASE_URL=&quot;postgresql://test:test@localhost:5432/test?schema=public&quot;
    API_PORT=${PORT}
    FOO=${FOO}
    BAR=${BAR}

$ export PORT=80
$ export FOO=myFooValue
$ export BAR=myBarValue
$ cat secret.yml | envsubst | kubectl apply -f -
</code></pre>
<p>A plus is for sure, that this not only allows for creation of the secret, but updating is also possible.</p>
<p>Just for documentation, here would be the full call with SOPS:</p>
<pre><code>$ sops --decrypt secret.enc.yml | envsubst | kubectl apply -f -
</code></pre>
