<p>I have a configmap like this</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  namespace: develop
  name: test-config
data:
  app.conf: |
    connection conn1
    address 127.0.0.1:8080
    user cluster1
    password: &lt;HERE COPY PASS FROM SECRET&gt;
</code></pre>

<p>app.conf section is mounted as a configuration file inside the container using</p>

<pre><code>spec:
  replicas: 1
  ...
    spec:
      containers:
        - name: container-name
          ...
          volumeMounts:
            - name: test-config-vol
              mountPath: /etc/app/app.conf
              subPath: app.conf
      volumes:
        - name: test-config-vol
          configMap:
            name: test-config
</code></pre>

<p>the app reading that file is NOT able to read environment variables, and I cannot change that behavior, it is a third party app.</p>

<p>I wonder how can I inject password from a secret into password field during pod deployment</p>

<p>You can't, what you can do is mounting a <a href="https://kubernetes.io/docs/concepts/configuration/secret" rel="nofollow noreferrer">Kuberentes secret</a> with the password - see the documentation <a href="https://kubernetes.io/docs/concepts/storage/volumes/#secret" rel="nofollow noreferrer">here</a>. So you'll end up having 2 files - one from the config map and one from the secret.</p>

<p>If your app does not support multiple config files, you'll have to store the entire config file on the secret instead of the config map.</p>

<p>Also, please note that Kubernetes secrets cannot be stored on source control, as the secret data is encoded using base64 (see <a href="https://kubernetes.io/docs/concepts/configuration/secret/#security-properties" rel="nofollow noreferrer">here</a> for more details). There are multiple solutions for this problem, check out my <a href="https://itnext.io/can-kubernetes-keep-a-secret-it-all-depends-what-tool-youre-using-498e5dee9c25" rel="nofollow noreferrer">post</a></p>
