<p>I have an application in a container which reads certain data from a configMap which goes like this</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  application.yaml: |
        server:
          port: 8080
          host: 0.0.0.0

        ##
        ## UCP configuration.
        ## If skipped, it will default to looking inside of the connections.xml file.
        database:
            ApplicationDB:
                username: username
                password: hello123
</code></pre>

<p>Now I created a secret for the password and mounted as env variable while starting the container.</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: appdbpassword
type: Opaque
stringData:
  password: hello123
</code></pre>

<p>My pod looks like:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: {{ .Values.pod.name }}
spec:
  containers:
    - name: {{ .Values.container.name }}
      image: {{ .Values.image }}
      command: [ "/bin/sh", "-c", "--" ]
      args: [ "while true; do sleep 30; done;"]
      env:
      - name: password
        valueFrom:
          secretKeyRef:
            name: appdbpassword
            key: password
      volumeMounts:
      - name: config-volume
        mountPath: /app/app-config/application.yaml
        subPath: application.yaml
  volumes:
    - name: config-volume
      configMap:
        name: app-config
</code></pre>

<p>I tried using this env variable inside the configMap:</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  application.yaml: |
        server:
          port: 8080
          host: 0.0.0.0

        ##
        ## UCP configuration.
        ## If skipped, it will default to looking inside of the connections.xml file.
        database:
            ApplicationDB:
                username: username
                **password: ${password}**
</code></pre>

<p>But my application is unable to read this password. Am I missing something here? </p>

<p>EDIT:</p>

<p>I cannot change the application.yaml to any other form as my server looks for application.yaml in source path. Do we have any way to use that environment variable in values.yaml(helm) file and use it in the configmap?</p>

Bhargav Behara
<p>You cannot use a secret in <code>ConfigMap</code> as they are intended to non-sensitive data (<a href="https://github.com/kubernetes/kubernetes/issues/79224" rel="nofollow noreferrer">See here</a>). </p>

<p>Also you should not pass <code>Secrets</code> using <code>env's</code> as it's create potential risk (Read more <a href="https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/" rel="nofollow noreferrer">here</a> why <code>env</code> shouldn't be 
used).
Applications usually dump <code>env</code> variables in error reports or even write the to the 
app logs at startup which could lead to exposing <code>Secrets</code>.</p>

<p>The best way would be to mount the <code>Secret</code> as file. 
Here's an simple example how to mount it as file: </p>

<pre><code>spec:
  template:
    spec:
      containers:
      - image: "my-image:latest"
        name: my-app
        ...
        volumeMounts:
          - mountPath: "/var/my-app"
            name: ssh-key
            readOnly: true
      volumes:
        - name: ssh-key
          secret:
            secretName: ssh-key
</code></pre>

<p>Kubernetes <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets" rel="nofollow noreferrer">documentation</a> explains well how to use and mount secrets.</p>
