<p>I am new to K8s. I am trying to deploy a Datadog agent to my cluster to collect logs and this happens through a ConfigMap.</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-cm
data:
  fluent-bit.conf: |
    [SERVICE]
        Parsers_File     parsers.conf
    
    [INPUT]
        name              tail
        path              /tmp/app.log
        parser            nginx

    [OUTPUT]
        Name           datadog
        Match          *
        Host           http-intake.logs.datadoghq.com
        TLS            off
        apikey         &lt;API key to be used confidentially&gt;
        dd_service     abcd
        dd_source      abcd
        dd_tags        env:dev

  parsers.conf: |
    [PARSER]
        Name   nginx
        Format regex
        Regex ^(?&lt;remote&gt;[^ ]*) (?&lt;host&gt;[^ ]*) (?&lt;user&gt;[^ ]*) \[(?&lt;time&gt;[^\]]*)\] &quot;(?&lt;method&gt;\S+)(?: +(?&lt;path&gt;[^\&quot;]*?)(?: +\S*)?)?&quot; (?&lt;code&gt;[^ ]*) (?&lt;size&gt;[^ ]*)(?: &quot;(?&lt;referer&gt;[^\&quot;]*))&quot; &quot;(?&lt;agent&gt;[^\&quot;]*)&quot;(?: &quot;(?&lt;target&gt;[^\&quot;]*))&quot;$
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z
</code></pre>
<p>I do not want to add the API key as plain text. Can I do it using secrets? Please suggest ways to achieve this.</p>
<p>P.S: I need to use the config map in order to add the Datadog agent, and hence the config map cannot be replaced.</p>

<p>In theory you could <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables" rel="nofollow noreferrer">Secret as a environment variable</a>, and pass it to a Pod using ConfigMap.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: fluentbit-secret-test
type: Opaque
data:
  apikey: &lt;base64 encoded api key&gt;
</code></pre>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-cm
data:
  fluent-bit.conf: |
...
        apikey         $FLUENTBIT_API_KEY
...
</code></pre>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: secret-env-test
spec:
  containers:
  - name: test
    image: nginx
    env:
      - name: FLUENTBIT_API_KEY
        valueFrom:
          secretKeyRef:
            name: fluentbit-secret-test
            key: apikey

</code></pre>
<p>However, you must remember, that Kubernetes Secrets are not encrypted by default, only base64 encoded. Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd</p>
