How to Inject a Kubernetes Secret as Environment Variables

Secrets are passive - you have to project them

Creating a Secret stores encrypted data in etcd. Nothing shows up in a container until you tell the pod spec where to put it. There are two ways:

• envFrom + secretRef - projects every key in the Secret as an env var
• env + secretKeyRef - pulls individual keys by name

envFrom is the fast, concise choice when you want the whole Secret available.

The envFrom pattern

Given a Secret named db-creds with keys DB_HOST, DB_USER, and DB_PASSWORD, wire it in with envFrom:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: my-app:latest
        envFrom:
        - secretRef:
            name: db-creds

Apply it and confirm the variables are present:

kubectl apply -f deployment.yaml
kubectl exec deploy/api -- env | grep DB_

You should see DB_HOST, DB_USER, and DB_PASSWORD in the output.

Per-key injection with secretKeyRef

When you only need specific keys - or need to rename them - use secretKeyRef under env instead:

env:
- name: DATABASE_URL
  valueFrom:
    secretKeyRef:
      name: db-creds
      key: DB_HOST

This gives you fine control: pick the key, set the env var name, and leave the rest of the Secret out of the container's environment.

Creating the Secret

If the Secret does not exist yet, create it from literal values:

kubectl create secret generic db-creds \
  --from-literal=DB_HOST=postgres.internal \
  --from-literal=DB_USER=app \
  --from-literal=DB_PASSWORD=s3cr3t

Or from a file of key=value pairs with --from-env-file=.env.

Common mistakes

• Wrong Secret name - the secretRef.name must match exactly; a typo leaves the pod in CreateContainerConfigError.
• Secret in the wrong namespace - a pod can only reference Secrets in its own namespace.
• Existing pods are not updated - after editing the Deployment spec, run kubectl rollout restart deployment/api if the pod was already running and the change did not trigger a rollout.