<p>I'm new to Kubernetes and I have a use case where I want to read data from another deployment.</p>
<p>In the following file, the the <code>RabbitmqCluster</code> creates a default user. I want to extract the credentials of that user into a secret for use in other services that need to publish or subscribe to that broker:</p>
<pre><code>apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
    name: broker
---
apiVersion: v1
kind: Secret
metadata:
    name: broker-credentials-secret
type: Opaque
stringData:
    username: $BROKER_USER # Available at $(kubectl get secret broker-default-user -o jsonpath='{.data.username}' | base64 --decode)
    password: $BROKER_PASSWORD # Available at $(kubectl get secret broker-default-user -o jsonpath='{.data.password}' | base64 --decode)
</code></pre>
<p>My first thought was to separate into two different files, I could wait for the cluster to be ready and then <code>sed</code> the <code>BROKER_PASSWORD</code> and <code>BROKER_USER</code> variables into the second config that then deploys the secret.</p>
<p>My question is: is there a proper way to handle this scenario? Should I just separate these two into two different files and write documentation about their intended order of deployment? Or is there a better way of doing this?</p>

jokarl
<p>Your thinking and approach is correct, this way (splitting into two files) seems to be the best option in this case - there is no way to dynamically set values in Kubernetes YAML from the other running Kubernetes resource. Keep in mind that for a secret definition you don't have to use the <code>stringData</code> and <code>base64 --decode</code> command in <code>kubectl</code>. It does not make any sense to decode values when they will be encoded again - better just read values in <code>base64</code> string and use <code>data</code> instead of <code>stringData</code> - <a href="https://kubernetes.io/docs/concepts/configuration/secret/#overview-of-secrets" rel="nofollow noreferrer">check this</a>. Finally all should look like:</p>
<p><em>file-1.yaml</em>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
    name: broker
</code></pre>
<p><em>file-2.yaml</em>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
    name: broker-credentials-secret
type: Opaque
data:
    username: BROKER_USER
    password: BROKER_PASSWORD
</code></pre>
<p>Then you can run this one-liner  (with <code>sed</code> commands + <a href="https://stackoverflow.com/questions/54032336/need-some-explaination-of-kubectl-stdin-and-pipe/54032630#54032630">using pipes</a> . I also deleted <code>$</code> signs in second yaml so <code>sed</code> commands work properly):</p>
<pre><code>kubectl apply -f file-1.yaml &amp;&amp; sed -e &quot;s/BROKER_USER/$(kubectl get secret broker-default-user -o jsonpath='{.data.username}')/g&quot; -e &quot;s/BROKER_PASSWORD/$(kubectl get secret broker-default-user -o jsonpath='{.data.password}')/g&quot; file-2.yaml | kubectl apply -f -
</code></pre>
