> For the complete documentation index, see [llms.txt](https://docs.release.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.release.com/reference-documentation/environment-settings/environment-specific-environment-variables/kubernetes-secrets-as-environment-variables.md).

# Kubernetes Secrets as environment variables

Importing secrets from Kubernetes

In addition to using Release [secrets vaults](/reference-documentation/environment-settings/environment-specific-environment-variables/secrets.md) to manage secret values from Release and external cloud providers, you can pull values from existing Kubernetes resources using `$secrets.k8s_secret.<ref-name>:<ref-key>` or `$secrets.k8s_configmap.<ref-name>:<ref-key>`.

```
key:
  type: String
  description: Environment variable name
  required: true
value:
  type: String
  description: Representation of the value to be fetched. $secrets.<k8s_secret|k8s_configmap>.<ref-name>:<ref-key> format. If secret is true, and this field is omitted, will use previously saved value.
  required: true (but hidden if secret)
secret:
  type: Boolean
  description: Value is secret and should be encrypted and not visible in the UI when viewing
  required: false, but required for Kubernetes secrets imports
```

## Use cases

To reference Kubernetes Secrets, a Kubernetes `Secret` or `ConfigMap` object must be present in your cluster so that you can provide a value from it as an environment variable to your services. The `Secret` or `ConfigMap` object does not need to be managed by Release and can be created through a Helm chart or by hand. An example of this is [Doppler](https://www.doppler.com/).

## Examples

The following example demonstrates how Release can create a Kubernetes `Secret` using a normal secret environment variable for an app called `apache-php`.

```yaml
defaults:
- key: NORMAL_SECRET
  value: documentation-value
  secret: true
- key: KUBERNETES_SECRET
  value: $secrets.k8s_secret.apache-php-secrets:normal-secret
  secret: true
```

When Release creates and deploys an environment, it will also create a Kubernetes `Secret` named `apache-php-secrets`. In this `Secret` object, `data` has the key `normal-secret`.

Now we can use the same value (`documentation-value`) in `KUBERNETES_SECRET` by using the secret reference format `$secrets.k8s_secret.apache-php-secrets:normal-secret`.

Here's the Kubernetes YAML Release will generate as a result:

```yaml
template:
  spec:
    containers:
    - env:
      - name: "KUBERNETES_SECRET", 
        valueFrom:
          secretKeyRef: 
            key: "normal-secret", 
            name: "apache-php-secrets"
      - name: "NORMAL_SECRET"
        valueFrom: 
          secretKeyRef: 
            key: "normal-secret"
            name: "apache-php-secrets"
```

To use a Kubernetes `ConfigMap` instead, follow the same process using `$secrets.k8s_configmap.existing-configmap:normal-secret`. Release will produce the following Kubernetes YAML:

```yaml
template:
  spec:
    containers:
    - env:
      - name: "KUBERNETES_SECRET", 
        valueFrom:
          configMapKeyRef: 
            key: "normal-secret", 
            name: "existing-configmap"
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.release.com/reference-documentation/environment-settings/environment-specific-environment-variables/kubernetes-secrets-as-environment-variables.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.