// This assembly is included in the following assemblies:
//
// assembly-kafka-connect-external-configuration.adoc

[id='proc-kafka-connect-mounting-secrets-as-environment-variables-{context}']

= Mounting Secrets as environment variables

You can create a Kubernetes Secret and mount it to Kafka Connect as an environment variable.

.Prerequisites

* A running Cluster Operator.

.Procedure

. Create a secret containing the information that will be mounted as an environment variable.
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: v1
kind: Secret
metadata:
  name: aws-creds
type: Opaque
data:
  awsAccessKey: QUtJQVhYWFhYWFhYWFhYWFg=
  awsSecretAccessKey: Ylhsd1lYTnpkMjl5WkE=
----

. Create or edit the Kafka Connect resource.
Configure the `externalConfiguration` section of the `KafkaConnect` or `KafkaConnectS2I` custom resource to reference the secret.
For example:
+
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaApiVersion}
kind: KafkaConnect
metadata:
  name: my-connect
spec:
  # ...
  externalConfiguration:
    env:
      - name: AWS_ACCESS_KEY_ID
        valueFrom:
          secretKeyRef:
            name: aws-creds
            key: awsAccessKey
      - name: AWS_SECRET_ACCESS_KEY
        valueFrom:
          secretKeyRef:
            name: aws-creds
            key: awsSecretAccessKey
----

. Apply the changes to your Kafka Connect deployment.
+
Use `kubectl apply`:
[source,shell,subs=+quotes]
kubectl apply -f _your-file_

The environment variables are now available for use when developing your connectors.

.Additional resources

* For more information about external configuration in Kafka Connect, see xref:type-ExternalConfiguration-reference[].