<p>I would like to have an environment variable that its value is a JSON String, that is built from the <code>ExternalSecrets</code> variables.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-app-external-secret
spec:
  refreshInterval: &quot;1h&quot;
  secretStoreRef:
    name: hashicorp-vault
    kind: ClusterSecretStore
  target:
    creationPolicy: Owner
  data:

  - secretKey: SECRET_KEY_A
    remoteRef:
      key: microservice/my-app
      property: secret_key_a

  - secretKey: SECRET_KEY_B
    remoteRef:
      key: microservice/my-app
      property: secret_key_b
</code></pre>
<p>The output should look like:</p>
<pre class="lang-json prettyprint-override"><code>{
    &quot;A&quot;: {
      &quot;secretKey&quot;: &quot;&lt;SECRET_KEY_A&gt;&quot;,
      &quot;someStaticValue&quot;: &quot;ABCDEF&quot;
    },
    &quot;B&quot;: {
      &quot;secretKey&quot;: &quot;&lt;SECRET_KEY_B&gt;&quot;,
      &quot;someStaticValue&quot;: &quot;FEDCBA&quot;
    }
}
</code></pre>
<p>So then I could export it in the <code>Deployment</code> and be able to use it as a JSON string, something that might look like this:</p>
<pre class="lang-yaml prettyprint-override"><code>- name: JSON_SECRETS
  valueFrom:
    secretKeyRef:
      name: my-app-external-secret
      key: jsonSecret
</code></pre>
<p>I've tried some stuff but didn't get it to work.
I can use <code>ConfigMap</code> if needed. I'm trying to achieve the following behavior in my app:
Whenever I need to implement a new secret, there is not need to modify the source code, only wait the refresh time or restart the pod. The application already knows how to handle the JSON, but I'm unable to create this JSON in the Kubernetes. It is a Java application, it doesn't need to be a JSON, it can also be a list.</p>

Johnnes Souza
<p>To build an environment variable in Kubernetes using a JSON string created from ExternalSecrets variables, use Kubernetes Jobs or CronJobs to update the environment variable with the needed JSON data on a regular basis. First, write a shell script that searches ExternalSecrets and creates the required JSON format. Vault CLI or any other tool that can access your ExternalSecrets can be used. <code>generate-json.sh</code> as an example:</p>
<pre class="lang-bash prettyprint-override"><code>#!/bin/sh

SECRET_KEY_A=$(vault read -field=secret_key_a secret microservice/my-app)
SECRET_KEY_B=$(vault read -field=secret_key_b secret microservice/my-app)

JSON=&quot;{&quot;
JSON=&quot;$JSON \&quot;A\&quot;: {\&quot;secretKey\&quot;: \&quot;$SECRET_KEY_A\&quot;, \&quot;someStaticValue\&quot;: \&quot;ABCDEF\&quot;},&quot;
JSON=&quot;$JSON \&quot;B\&quot;: {\&quot;secretKey\&quot;: \&quot;$SECRET_KEY_B\&quot;, \&quot;someStaticValue\&quot;: \&quot;FEDCBA\&quot;}&quot;
JSON=&quot;$JSON }&quot;

echo &quot;$JSON&quot; &gt; /path/to/output/json.json
</code></pre>
<p>You may include the shell script in a ConfigMap and declare it as executable.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: json-generator
data:
  generate-json.sh: |
    #!/bin/sh

    # (Contents of the shell script)
</code></pre>
<p>Make a CronJob that executes the shell script on a regular basis to produce the JSON and save it in a ConfigMap.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: json-generator-cron
spec:
  schedule: &quot;0 */1 * * *&quot;  # Run every 1 hour
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: json-generator
              image: your-custom-image:latest  # Image with Vault CLI or required tools
              command: [&quot;/bin/sh&quot;, &quot;/path/to/script/generate-json.sh&quot;]
              volumeMounts:
                - name: output-volume
                  mountPath: /path/to/output
          volumes:
            - name: output-volume
              emptyDir: {}
</code></pre>
<p>Create a Pod in your deployment that references the produced JSON from the ConfigMap as an environment variable.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app-deployment
spec:
  template:
    spec:
      containers:
        - name: my-app-container
          image: your-app-image:latest
          env:
            - name: JSON_SECRETS
              valueFrom:
                configMapKeyRef:
                  name: json-generator
                  key: /path/to/output/json.json
</code></pre>
<p>With this configuration, the CronJob creates JSON using your ExternalSecrets data on a regular basis and saves it in a ConfigMap. The Pod in your application then refers to this ConfigMap to set the <code>JSON_SECRETS</code> environment variable. When you add or alter secrets in ExternalSecrets, the CronJob will automatically refresh the JSON, and your application will pick up the changes on the next Pod restart or as scheduled. Ascertain that the CronJob's <code>json-generator</code> container has the appropriate rights to access your private store (e.g., Vault) and write to the ConfigMap.</p>
