Kubernetes

Our Kubernetes plugin enables loading values from Kubernetes Secrets and ConfigMaps using declarative instructions within your .env files.

Scope

This plugin is read-only. It performs get requests on Secrets and ConfigMaps in a configured namespace and surfaces the values to your .env schema, nothing more. It does not create, update, or delete cluster resources, generate or template manifests, watch for changes, or manage deployments.

Typical use cases:

• Local development: pull dev/staging Secrets and ConfigMaps from a cluster into your local app without copying values by hand
• In-cluster runtime: read additional Secrets/ConfigMaps at runtime that aren’t already mounted into the pod via envFrom / valueFrom
• CI/CD: read Secrets/ConfigMaps from a cluster using an explicit service account token

It supports local kubeconfig, in-cluster service account credentials, and explicit API server + token authentication.

Want deeper Kubernetes integration?

We’re considering broader Kubernetes support (manifest generation, schema-to-deployment validation, change watching, etc.). If you have a use case this plugin doesn’t cover, or feedback from running it in production, come chat on Discord. We’d love to hear from you.

Features

• Zero-config local development: automatically uses your default kubeconfig (~/.kube/config)
• In-cluster authentication: auto-detects the mounted service account when running inside a pod
• Explicit auth: provide a cluster API URL and bearer token directly
• Fetch Secret keys with k8sSecret() (values are automatically base64-decoded)
• Fetch ConfigMap keys with k8sConfigMap() (including binaryData)
• Bulk-load whole Secrets or ConfigMaps with k8sSecretBulk() / k8sConfigMapBulk()
• Auto-infer keys from environment variable names
• Multiple instances for different namespaces or clusters
• Read-only: the plugin never mutates cluster state

Guides in this section

• Installation and setup
• Loading values
• Kubernetes setup
• Reference