<p>I read in the <a href="https://github.com/hashicorp/envconsul" rel="nofollow noreferrer">envconsul documentation</a> this:</p>

<blockquote>
  <p>For additional security, tokens may also be read from the environment
  using the CONSUL_TOKEN or VAULT_TOKEN environment variables
  respectively. It is highly recommended that you do not put your tokens
  in plain-text in a configuration file.</p>
</blockquote>

<p>So, I have this <code>envconsul.hcl</code> file:</p>

<pre><code># the settings to connect to vault server
# "http://10.0.2.2:8200" is the Vault's address on the host machine when using Minikube
vault {
  address = "${env(VAULT_ADDR)}"
  renew_token = false
  retry {
    backoff = "1s"
  }
  token = "${env(VAULT_TOKEN)}"
}
# the settings to find the endpoint of the secrets engine
secret {
    no_prefix = true
    path = "secret/app/config"
}

</code></pre>

<p>However, I get this error:</p>

<pre><code>[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Get $%7Benv%28VAULT_ADDR%29%7D/v1/secret/app/config: unsupported protocol scheme "" (retry attempt 1 after "1s")
</code></pre>

<p>As I understand it, it cannot do the variable substitution.<br>
I tried to set <code>"http://10.0.2.2:8200"</code> and it works.</p>

<p>The same happens with the <code>VAULT_TOKEN</code> var.<br>
If I hardcode the <code>VAULT_ADDR</code>, then I get this error:</p>

<pre><code>[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Error making API request.

URL: GET http://10.0.2.2:8200/v1/secret/app/config
Code: 403. Errors:

* permission denied (retry attempt 2 after "2s")
</code></pre>

<p>Is there a way for this file to understand the environmental variables?</p>

<p><strong>EDIT 1</strong>
This is my <code>pod.yml</code> file</p>

<pre><code>---
apiVersion: v1
kind: Pod
metadata:
  name: sample
spec:
  serviceAccountName: vault-auth

  restartPolicy: Never

  # Add the ConfigMap as a volume to the Pod
  volumes:
    - name: vault-token
      emptyDir:
        medium: Memory
    # Populate the volume with config map data
    - name: config
      configMap:
        # `name` here must match the name 
        # specified in the ConfigMap's YAML
        # -&gt; kubectl create configmap vault-cm --from-file=./vault-configs/
        name: vault-cm
        items:
          - key : vault-agent-config.hcl
            path: vault-agent-config.hcl
          - key : envconsul.hcl
            path: envconsul.hcl

  initContainers:
    # Vault container
    - name: vault-agent-auth
      image: vault

      volumeMounts:
        - name: vault-token
          mountPath: /home/vault
        - name: config
          mountPath: /etc/vault

      # This assumes Vault running on local host and K8s running in Minikube using VirtualBox
      env:
        - name: VAULT_ADDR
          value: http://10.0.2.2:8200

      # Run the Vault agent
      args:
        [
          "agent",
          "-config=/etc/vault/vault-agent-config.hcl",
          "-log-level=debug",
        ]

  containers:
    - name: python
      image: myappimg
      imagePullPolicy: Never
      ports:
        - containerPort: 5000
      volumeMounts:
        - name: vault-token
          mountPath: /home/vault
        - name: config
          mountPath: /etc/envconsul
      env:
        - name: HOME
          value: /home/vault
        - name: VAULT_ADDR
          value: http://10.0.2.2:8200

</code></pre>

<p>I. Within container specification set environmental variables (values in double quotes):</p>

<pre><code>env:
  - name: VAULT_TOKEN
    value: "abcd1234"
  - name: VAULT_ADDR
    value: "http://10.0.2.2:8200"
</code></pre>

<p>Then refer to the values in envconsul.hcl </p>

<pre><code>vault {
  address = ${VAULT_ADDR}
  renew_token = false
  retry {
    backoff = "1s"
  }
  token = ${VAULT_TOKEN}
}
</code></pre>

<p>II. Another option is to unseal the vault cluster (with the unseal key which was printed while initializing the vault cluster) </p>

<pre><code>$ vault operator unseal
</code></pre>

<p>and then authenticate to the vault cluster using a root token. </p>

<pre><code>$ vault login &lt;your-generated-root-token&gt;
</code></pre>

<p>More <a href="https://blog.kubernauts.io/managing-secrets-in-kubernetes-with-vault-by-hashicorp-f0db45cc208a" rel="nofollow noreferrer">details</a> </p>
