<p>I am trying to map kubernetes secret value to a environment variable . My secret is as shown below</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: test-secret
type: opaque
data:
  tls.crt: {{ required &quot;A valid value is required for tls.crt&quot;  .Values.tlscrt }}
</code></pre>
<p>Mapped the key to environment variable in the deployment yaml</p>
<pre><code> env:
 - name: TEST_VALUE
   valueFrom:
       secretKeyRef:
          name: test-secret
          key: tls.crt
</code></pre>
<p>The value gets mapped when i do helm install. However when i do helm upgrade , the changed value is not reflected in the environment variable , it still has the old value. Can anyone please help here ?</p>

<h2>If the configMap is used to store pod environment variables</h2>
<blockquote>
<p><strong>ConfigMaps consumed as environment variables are not updated automatically and require a pod restart.</strong></p>
</blockquote>
<p>There are ways to automate pod restarts on configMap changes, see here for example: <a href="https://stackoverflow.com/questions/52658839/helm-chart-restart-pods-when-configmap-changes">Helm chart restart pods when configmap changes</a></p>
<h2>If the configMap is mounted as a file</h2>
<p>In this case pod should see an update, although with some delay:</p>
<blockquote>
<p>When a ConfigMap currently consumed in a volume is updated, projected keys are eventually updated as well. The kubelet checks whether the mounted ConfigMap is fresh on every periodic sync. However, the kubelet uses its local cache for getting the current value of the ConfigMap. The type of the cache is configurable using the <code>configMapAndSecretChangeDetectionStrategy</code> field in the <a href="https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/" rel="nofollow noreferrer">KubeletConfiguration struct</a>. A ConfigMap can be either propagated by watch (default), ttl-based, or by redirecting all requests directly to the API server. As a result, the total delay from the moment when the ConfigMap is updated to the moment when new keys are projected to the Pod can be as long as the kubelet sync period + cache propagation delay, where the cache propagation delay depends on the chosen cache type (it equals to watch propagation delay, ttl of cache, or zero correspondingly).</p>
</blockquote>
<p>Quotes taken from <a href="https://kubernetes.io/docs/concepts/configuration/configmap/#mounted-configmaps-are-updated-automatically" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/configuration/configmap/#mounted-configmaps-are-updated-automatically</a> (thanks to @jeremysprofile)</p>
