Import data to config map from kubernetes secret

Kubernetes can't make that substitution for you, you should do it with shell in the entrypoint of the container.

This is a working example. I modify the default entrypoint to create a new variable with that substitution. After this command you should add the desired entrypoint.

apiVersion: extensions/v1beta1kind: Deploymentmetadata:  name: app  labels:    app: backendspec:  replicas: 1  template:    metadata:      labels:        app: backend    spec:      containers:      - name: app        image: simple-app-image        command:          - /bin/bash          - -c        args:          - "NEW_APP_CONFIG=$(echo $APP_CONFIG | envsubst) && echo $NEW_APP_CONFIG && <INSERT IMAGE ENTRYPOINT HERE>"        ports:          - name: "app"            containerPort: 8080        env:          - name: APP_CONFIG            valueFrom:              configMapKeyRef:                name: config                key: APP_CONFIG          - name: DB_PASSWORD            valueFrom:              secretKeyRef:                name: "mysql-secret"                key: "mysql-root-password"

I would transform the whole configMap into a secret and deploy the database password directly in there.Then you can mount the secret as a file to a volume and use it like a regular config file in the container.