<p>I am trying to deploy a mariadb deployment , I have the root password from GCP Secret Manager  and stored in a volume mount.
I need a way to give the env var the value from that file , please check line 38 .</p>
<pre><code>  1 apiVersion: apps/v1
  2 kind: Deployment
  3 metadata:
  4   name: mariadb-deployment
  5   namespace: readonly-ns
  6 spec:
  7   replicas:
  8   selector:
  9     matchLabels:
 10       app: mariadb
 11   template:
 12     metadata:
 13       labels:
 14         app: mariadb
 15     spec:
 16       volumes:
 17         - name: cert-volume
 18           emptyDir: {}
 19       serviceAccountName: readonly-sa
 20       initContainers:
 21         - name: init
 22           image: google/cloud-sdk:slim
 23           command: [&quot;/bin/sh&quot;]
 24           args:
 25             - -c
 26             - &gt;-
 27                 gcloud secrets versions access &quot;latest&quot; --secret=bq-readonly-key &gt; /etc/gsm/key.pem
 28           volumeMounts:
 29            - name: cert-volume
 30              mountPath: /etc/gsm/
 31       containers:
 32       - name: mariadb
 33         image: mariadb
 34         ports:
 35         - containerPort: 3306
 36         env:
 37         - name: MARIADB_ROOT_PASSWORD
 38           value: &quot;/etc/gsm/key.pem&quot;       # I need a way to give this env var a value from that file path
 39         volumeMounts:
 40          - name: cert-volume
 41            mountPath: /etc/gsm/
</code></pre>
<p>I could not find it online, there is Secret and configMap , but those are not an option for me .</p>

Krikor Garabed Kafalian
<p>There is a way to create a secret or configmap using a Job with access to create, and update resources on Kubernetes. I think you can adapt it to a init container for example.</p>
<p>ServiceAccount, Role and RoleBiding:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: secret-creator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-creator
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  verbs: [&quot;create&quot;, &quot;update&quot;, &quot;get&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: secret-creator
subjects:
- kind: User
  name: system:serviceaccount:default:secret-creator
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: secret-creator
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>Job:</p>
<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  name: secret-creator
spec:
  template:
    metadata:
    spec:
      volumes:
        - name: cert-volume
          persistentVolumeClaim:
            claimName: my-existent-pvc
      serviceAccountName: secret-creator
      serviceAccount: secret-creator
      containers:
      - image: bitnami/kubectl
        name: secret-creator
        command:
          - /bin/bash
          - -c
        args:
          - kubectl create secret generic app-x-secret --from-file=/etc/sec/key.pem
        resources: {}
        volumeMounts:
         - name: cert-volume
           mountPath: /etc/sec/key.pem
           subPath: key.pem
      restartPolicy: Never
</code></pre>
<p>Deployment:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: app
  name: app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app
  template:
    metadata:
      labels:
        app: app
    spec:
      containers:
      - image: bitnami/bitnami-shell
        name: app
        command:
        - /bin/bash
        - -c
        args:
        - sleep 360
        env:
          - name: APP_PASSWORD
            valueFrom:
              secretKeyRef:
                name: app-x-secret
                key: key.pem
</code></pre>
<p>Github: <a href="https://github.com/marcosrosse/k8s-secret-from-volume" rel="nofollow noreferrer">https://github.com/marcosrosse/k8s-secret-from-volume</a></p>
