<p>In Kubernetes, how can I expose secrets in a file (in a Kubernetes volume) as environment variables instead?</p>

<p><strong>Background:</strong><br>
I followed the <a href="https://github.com/GoogleCloudPlatform/gke-vault-demo" rel="nofollow noreferrer">Google Cloud Platform GKE Vault Demo</a> and in it, they show how to <em>"continuously fetching a secret's contents onto a local file location. This allows the application to read secrets from a file inside the pod normally without needing to be modified to interact with Vault directly."</em>  </p>

<p>I would like to know how I can expose these secrets as environment variables (instead of a file) for the other application containers to use.</p>

cryanbhu
<p>I found out how to inject the secrets from the file into the application container.  </p>

<p>First, the secrets file should be in the form <code>KEY="VALUE"</code> on each line.<br>
For those using Consul Template to get the secrets from Vault, you can do it as such:  </p>

<pre><code>- name: CT_LOCAL_CONFIG
      value: |
        vault {
          ssl {
            ca_cert = "/etc/vault/tls/ca.pem"
          }
          retry {
            backoff = "1s"
          }
        }
        template {
          contents = &lt;&lt;EOH
        {{- with secret "secret/myproject/dev/module1/mongo-readonly" }}
        MONGO_READ_HOSTNAME="{{ .Data.hostname }}"
        MONGO_READ_PORT="{{ .Data.port }}"
        MONGO_READ_USERNAME="{{ .Data.username }}"
        MONGO_READ_PASSWORD="{{ .Data.password }}"
        {{- end }}
        {{- with secret "secret/myproject/dev/module2/postgres-readonly" }}
        POSTGRES_READ_HOSTNAME="{{ .Data.hostname }}"
        POSTGRES_READ_PORT="{{ .Data.port }}"
        POSTGRES_READ_USERNAME="{{ .Data.username }}"
        POSTGRES_READ_PASSWORD="{{ .Data.password }}"
        {{- end }}
        EOH
          destination = "/etc/secrets/myproject/config"
        }  
</code></pre>

<p>This will result in a secrets file in the correct <code>KEY="VALUE"</code> form.  </p>

<p>From the secrets file, which is shared to the app container through <code>volumeMount</code>, we can inject the secrets as environment variables like this:  </p>

<pre><code>command: ["/bin/bash", "-c"]  # for Python image, /bin/sh doesn't work, /bin/bash has source
args:
  - source /etc/secrets/myproject/config;
    export MONGO_READ_HOSTNAME;
    export MONGO_READ_PORT;
    export MONGO_READ_USERNAME;
    export MONGO_READ_PASSWORD;
    export POSTGRES_READ_HOSTNAME;
    export POSTGRES_READ_PORT;
    export POSTGRES_READ_USERNAME;
    export POSTGRES_READ_PASSWORD;
    python3 my_app.py;  
</code></pre>

<p>In this way, we don't have to modify existing application code which expects secrets from environment variables (used to use Kubernetes Secrets).  </p>
