:_mod-docs-content-type: PROCEDURE

// Module included in the following assemblies:
//
// configuring/assembly-external-config.adoc

[id='proc-loading-config-from-env-vars-{context}']
= Loading configuration values from environment variables

[role="_abstract"]
Use the `EnvVarConfigProvider` to provide configuration properties as environment variables.
Environment variables can contain values from config maps or secrets.

In this procedure, environment variables provide configuration properties for a connector to communicate with Amazon AWS.
The connector must be able to read the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
The values of the environment variables are derived from a secret mounted into the Kafka Connect pod.

NOTE: The names of user-defined environment variables cannot start with `KAFKA_` or `STRIMZI_`.

.Prerequisites

* A Kafka cluster is running.
* The Cluster Operator is running.
* You have a secret containing the connector configuration.

.Example secret with values for environment variables
[source,yaml,subs=attributes+]
----
apiVersion: v1
kind: Secret
metadata:
  name: aws-creds
type: Opaque
data:
  awsAccessKey: QUtJQVhYWFhYWFhYWFhYWFg=
  awsSecretAccessKey: Ylhsd1lYTnpkMjl5WkE=
----

.Procedure

. Configure the `KafkaConnect` resource.
+
--
* Enable the `EnvVarConfigProvider`
* Specify the environment variables using the `template` property.
--
+
.Example Kafka Connect configuration to use external environment variables
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaConnectApiVersion}
kind: KafkaConnect
metadata:
  name: my-connect
  annotations:
    strimzi.io/use-connector-resources: "true"
spec:
  # ...
  config:
    # ...
    config.providers: env # <1>
    config.providers.env.class: org.apache.kafka.common.config.provider.EnvVarConfigProvider # <2>
  # ...
  template:
    connectContainer:
      env:
        - name: AWS_ACCESS_KEY_ID # <3>
          valueFrom:
            secretKeyRef:
              name: aws-creds # <4>
              key: awsAccessKey # <5>
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: aws-creds
              key: awsSecretAccessKey
  # ...
----
<1> The alias for the configuration provider is used to define other configuration parameters.
The provider parameters use the alias from `config.providers`, taking the form `config.providers.${alias}.class`.
<2> `EnvVarConfigProvider` provides values from environment variables.
<3> The environment variable takes a value from the secret.
<4> The name of the secret containing the environment variable.
<5> The name of the key stored in the secret.
+
NOTE: The `secretKeyRef` property references keys in a secret.
If you are using a config map instead of a secret, use the `configMapKeyRef` property.

. Create or update the resource to enable the provider.
+
[source,shell,subs=+quotes]
----
kubectl apply -f <kafka_connect_configuration_file>
----

. Reference the environment variable in the connector configuration.
+
.Example connector configuration referencing the environment variable
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaConnectorApiVersion}
kind: KafkaConnector
metadata:
  name: my-connector
  labels:
    strimzi.io/cluster: my-connect
spec:
  # ...
  config:
    option: ${env:AWS_ACCESS_KEY_ID}
    option: ${env:AWS_SECRET_ACCESS_KEY}
    # ...
# ...
----
+
The placeholder structure is `env:<environment_variable_name>`.
`EnvVarConfigProvider` reads and extracts the environment variable values from the mounted secret.