<p>I am using Helm charts to create and deploy applications into my K8s cluster. </p>

<p>One of my pods requires a config file with a SDK key to start and function properly. This SDK key is considered a secret and is stored in AWS Secret Manager. I don't include the secret data in my Docker image. I want to be able to mount this config file at runtime. A ConfigMap seems to be a good option in this case, except that I have not been able to figure out how to obtain the SDK key from Secrets Manager during the chart installation. Part of my ConfigMap looks like this:</p>

<pre><code>   data:
      app.conf: |
      [sdkkey] # I want to be able to retrieve sdk from aws secrets manager
</code></pre>

<p>I was looking at ways to write shell commands to use AWS CLI to get secrets, but have not seen a way to execute shell commands from within a ConfigMap. </p>

<p>Any ideas or alternative solutions?</p>

<p>Cheers
K</p>

Karthik Balasubramanian
<p><em>tl;dr;</em> You can't execute a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/" rel="nofollow noreferrer">ConfigMap</a>, it is just a static manifest. Use an <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">init container</a> instead.</p>

<p>ConfigMaps are a static manifest that can be read from the Kubernetes API or injected into a container at runtime as a file or environment variables. There is no way to execute a ConfigMap. </p>

<p>Additionally, ConfigMaps should not be used for secret data, Kubernetes has a specific resource, called <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secrets</a>, to use for secret data. It can be used in similar ways to a ConfigMap, including being mounted as a volume or exposed as environment variables within the container.</p>

<p>Given your description it sounds like your best option would be to use an <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">init container</a> to retrieve the credentials and write them to a shared <a href="https://kubernetes.io/docs/concepts/storage/volumes/#emptydir" rel="nofollow noreferrer">emptyDir Volume</a> mounted into the container with the application that will use the credentials. </p>
