<p>I have a <code>yaml</code> file which needs to be loaded into my <code>pods</code>, this <code>yaml</code> file will have both sensitive and non-sensitive data, this <code>yaml</code> file need to be present in a path which i have included as <code>env</code> in containers.</p>
<pre><code>        env:
          - name:  CONFIG_PATH
            value: /myapp/config/config.yaml
</code></pre>
<p>If my understanding is right, the <code>configmap</code> was the right choice, but i am forced to give the sensitive data like password as plain text in the <code>values.yaml</code> in <code>helm</code> chart.</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-config
  labels:
    app: {{ .Release.Name }}-config
data:
  config.yaml: |

    configuration: 
      settings: 
        Password: &quot;{{.Values.config.password}}&quot;
        Username: myuser
</code></pre>
<p><code>Values.yaml</code></p>
<pre><code>config:
  password: &quot;mypassword&quot;
</code></pre>
<p>Mounted the above config map as follows</p>
<pre><code>        volumeMounts:
          - name:  {{ .Release.Name }}-config
            mountPath:  /myapp/config/
</code></pre>
<p>So i wanted to try <code>secret</code>, If i try secret, it is loading as <code>Environment Variables</code> inside pod, but it is not going into this <code>config.yaml</code> file.</p>
<p>If i convert the above <code>yaml</code> file into <code>secret</code> instead of <code>configmap</code> , should i convert the entire <code>config.yaml</code> into <code>base64</code> secret? my <code>yaml</code> file has more entries and it will look cumbersome and i dont think it as a solution.
If i take <code>secret</code> as a <code>stringdata</code> then the <code>base64</code> will be taken as it is.</p>
<p>How do i make sure that <code>config.yaml</code> loads into pods with <code>passwords</code> not exposed in the <code>values.yaml</code> Is there a way to combine <code>configmap</code> and <code>secret</code>
I read about <code>projected</code> volumes, but i dont see a use case for merging <code>configmap</code> and <code>secrets</code> into single <code>config.yaml</code>
Any help would be appreciated.</p>

windowws
<p>Kubernetes has no real way to construct files out of several parts.  You can embed an entire (small) file in a ConfigMap or a Secret, but you can't ask the cluster to assemble a file out of parts in multiple places.</p>
<p>In Helm, one thing you can do is to put the configuration-file data into a helper template</p>
<pre class="lang-yaml prettyprint-override"><code>{{- define &quot;config.yaml&quot; -}}
configuration: 
  settings: 
    Password: &quot;{{.Values.config.password}}&quot;
    Username: myuser
{{ end -}}
</code></pre>
<p>In the ConfigMap you can use this helper template rather than embedding the content directly</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ConfigMap
metadata: { ... }
data:
  config.yaml: |
{{ include &quot;config.yaml&quot; . | indent 4 }}
</code></pre>
<p>If you move it to a Secret you do in fact need to base64 encode it.  But with the helper template that's just a matter of invoking the template and encoding the result.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata: { ... }
data:
  config.yaml: {{ include &quot;config.yaml&quot; . | b64enc }}
</code></pre>
<p>If it's possible to set properties in this file directly via environment variables (like Spring properties) or to insert environment-variable references in the file (like a Ruby ERB file) that could let you put the bulk of the file into a ConfigMap, but use a Secret for specific values; you would need a little more wiring to also make the environment variables available.</p>
<p>You briefly note a concern around passing the credential as a Helm value.  This does in fact require having it in plain text at deploy time, and an operator could <code>helm get values</code> later to retrieve it.  If this is a problem, you'll need some other path to inject or retrieve the secret value.</p>
