<h2>Files structure (minimized)</h2>

<p>There is a <em>charts</em> folder containing multiple charts.</p>

<pre><code>charts/
  foo-chart/
    templates/
       deployment.yml
       secrets.yml
  bar-chart/
    templates/
      configmaps/
        script.yml
</code></pre>

<h3>secrets.yml</h3>

<p>Defines a token:</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: {{ .Release.Name }}-secret
  labels:
    app: {{ include "metrics.name" . }}
    chart: {{ include "metrics.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
type: Opaque
data:
  # NOTE: Service token has to fit the NIST requirement
  serviceToken: {{ randAscii 40 | b64enc }}
</code></pre>

<h3>deployment.yml</h3>

<p>Runs a command which uses an environmental variable which uses a secret:</p>

<pre><code>containers:
  command:
  - fancy-binary
  - -token
  - $(AUTH_TOKEN)
  env:
  - name: AUTH_TOKEN
  valueFrom:
    secretKeyRef:
    name: {{ .Release.Name }}-secret
    key: serviceToken
</code></pre>

<h3>script.yml</h3>

<p>Is supposed to run bash command (Django admin-command) and use environmental variable as well:</p>

<pre><code># Create a Service Token
django-admin service_token_add $(AUTH_TOKEN)
</code></pre>

<hr>

<h2>Issues</h2>

<ol>
<li>Is the <code>AUTH_TOKEN</code> going to be visible in <em>script.yml</em>?</li>
<li>Does the <code>env</code> <code>valueFrom</code> auto-set the value of <code>AUTH_TOKEN</code> (is deployment going to work)?</li>
</ol>

0leg
<p>Answering to your first question, environment variables passed through <code>env</code> field of a container will be visible everywhere in your container
so also in the script you run unless you explicitly unset it.</p>

<p>You can check it by creating this (you should be able to copypaste the example):</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: test-secret
type: Opaque
data:
  serviceToken: MTIzNDU2Nzg5MAo=     # base64 encoded string: "1234567890"

---
apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - args:
    - echo
    - hello
    - $(AUTH_TOKEN)
    name: test
    env:
    - name: AUTH_TOKEN
      valueFrom:
          secretKeyRef:
          name: test-secret
          key: serviceToken
    image: centos:7
  restartPolicy: Never
</code></pre>

<p>and then when pod completes, check logs and you will see your token:</p>

<pre><code>$ kubectl logs test
hello 1234567890
</code></pre>

<p>The same applies to scripts.</p>

<p>Answering you second question; as you probably already saw in example above, using env valueFrom will indeed auto-set your env to the value from secret.</p>

<p>Let me know if it was helpful.</p>
