# Hcl environment variables parsing

**URL:** <https://discuss.hashicorp.com/t/hcl-environment-variables-parsing/17342>\
**Category:** Vault\
**Tags:** k8s, vault\
**Created:** [November 8, 2020, 9:28am UTC](https://discuss.hashicorp.com/t/hcl-environment-variables-parsing/17342 "2020-11-08T09:28:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![prosperazagy](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/prosperazagy/32/10474_2.png) [@prosperazagy](https://discuss.hashicorp.com/u/prosperazagy)\
**Post date:** [November 8, 2020, 9:28am UTC](https://discuss.hashicorp.com/t/hcl-environment-variables-parsing/17342/1 "2020-11-08T09:28:43Z")

</div>

Hello, I have a vault deployment on my openshift cluster,  
I would like to use secrets for my backend credentials.  
I use a postgres backend. I added the secrets to the porject, and imported them as environment variables to my deployment.  
Now, when I try to use the in my configmap, the vault cant parse my connection string when I’m using environment variables.

```
storage "postgresql" {
    connection_url = "postgres://${user}:${password}:5432/${name}?search_path=${schema}" 
    ...
    ...
}

```

This configuration works when I replace the variables with plain text.

---

<div class="post-metadata">

**Author:** ![martinhristov90](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/martinhristov90/32/36757_2.png) [@martinhristov90](https://discuss.hashicorp.com/u/martinhristov90)\
**Post date:** [November 9, 2020, 7:38am UTC](https://discuss.hashicorp.com/t/hcl-environment-variables-parsing/17342/2 "2020-11-09T07:38:54Z")

</div>

Hello,

I understand your concerns. I have found a way to secure the secrets inside the Vault’s config file using SOPS. The usage is like `sops exec-file secret.enc.json 'vault server -config={}`. They have more detailed information on their SOPS github page.

Martin