<p>I am trying to update a helm-deployed deployment so that it uses a secret stored as a k8s secret resource.  This <em>must</em> be set as the STORAGE_PASSWORD environment variable in my pod.</p>
<p>In my case, the secret is in secrets/redis and the data item is redis-password:</p>
<pre>
$ kubectl get secret/redis -oyaml
apiVersion: v1
data:
  redis-password: XXXXXXXXXXXXXXXX=
kind: Secret
metadata:
  name: redis
type: Opaque
</pre>
<p>I have tried:</p>
<pre>
$ kubectl set env --from secret/redis deployment/gateway --keys=redis-password
Warning: key redis-password transferred to REDIS_PASSWORD
deployment.apps/gateway env updated
</pre>
<p>When I look in my updated deployment manifest, I see the variable has been added but (as suggested) the variable has been set to REDIS_PASSWORD:</p>
<pre>
        - name: REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              key: redis-password
              name: redis

</pre>
<p>I have also tried <code>kubectl patch</code> with a <code>replace</code> operation, but I can't get the syntax correct to have the secret inserted.</p>
<p>How do I change the name of the environment variable to STORAGE_PASSWORD?</p>

Jeff W
<p>Given a deployment that looks like this:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: example
spec:
  replicas: 1
  template:
    spec:
      containers:
        - image: alpinelinux/darkhttpd
          name: darkhttpd
          args:
            - --port
            - &quot;9991&quot;
          ports:
            - name: http
              protocol: TCP
              containerPort: 9991
          env:
            - name: EXAMPLE_VAR
              value: example value
</code></pre>
<p>The syntax for patching in your secret would look like:</p>
<pre><code>kubectl patch deploy/example --patch='
  {
    &quot;spec&quot;: {
      &quot;template&quot;: {
        &quot;spec&quot;: {
          &quot;containers&quot;: [
            {
              &quot;name&quot;: &quot;darkhttpd&quot;,
              &quot;env&quot;: [
                {
                  &quot;name&quot;: &quot;STORAGE_PASSWORD&quot;,
                  &quot;valueFrom&quot;: {
                    &quot;secretKeyRef&quot;: {
                      &quot;name&quot;: &quot;redis&quot;,
                      &quot;key&quot;: &quot;redis-password&quot;
                    }
                  }
                }
              ]
            }
          ]
        }
      }
    }
  }
'
</code></pre>
<p>Or using a JSONPatch style patch:</p>
<pre><code>kubectl patch --type json deploy/example --patch='
[
  {
    &quot;op&quot;: &quot;add&quot;,
    &quot;path&quot;: &quot;/spec/template/spec/containers/0/env/-&quot;,
    &quot;value&quot;: {
      &quot;name&quot;: &quot;STORAGE_PASSWORD&quot;,
      &quot;valueFrom&quot;: {
        &quot;secretKeyRef&quot;: {
          &quot;name&quot;: &quot;redis&quot;,
          &quot;key&quot;: &quot;redis-password&quot;
        }
      }
    }
  }
]
'
</code></pre>
<p>Neither one is especially pretty because you're adding a complex nested structure to an existing complex nested structure.</p>
