title: How to pass environmental variables in envconsul config file?
body: <p>I read in the <a href="https://github.com/hashicorp/envconsul" rel="nofollow noreferrer">envconsul documentation</a> this:</p>
  
  <blockquote>
    <p>For additional security, tokens may also be read from the environment
    using the CONSUL_TOKEN or VAULT_TOKEN environment variables
    respectively. It is highly recommended that you do not put your tokens
    in plain-text in a configuration file.</p>
  </blockquote>
  
  <p>So, I have this <code>envconsul.hcl</code> file:</p>
  
  <pre><code># the settings to connect to vault server
  # "http://10.0.2.2:8200" is the Vault's address on the host machine when using Minikube
  vault {
    address = "${env(VAULT_ADDR)}"
    renew_token = false
    retry {
      backoff = "1s"
    }
    token = "${env(VAULT_TOKEN)}"
  }
  # the settings to find the endpoint of the secrets engine
  secret {
      no_prefix = true
      path = "secret/app/config"
  }
  
  </code></pre>
  
  <p>However, I get this error:</p>
  
  <pre><code>[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Get $%7Benv%28VAULT_ADDR%29%7D/v1/secret/app/config: unsupported protocol scheme "" (retry attempt 1 after "1s")
  </code></pre>
  
  <p>As I understand it, it cannot do the variable substitution.<br>
  I tried to set <code>"http://10.0.2.2:8200"</code> and it works.</p>
  
  <p>The same happens with the <code>VAULT_TOKEN</code> var.<br>
  If I hardcode the <code>VAULT_ADDR</code>, then I get this error:</p>
  
  <pre><code>[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Error making API request.
  
  URL: GET http://10.0.2.2:8200/v1/secret/app/config
  Code: 403. Errors:
  
  * permission denied (retry attempt 2 after "2s")
  </code></pre>
  
  <p>Is there a way for this file to understand the environmental variables?</p>
  
  <p><strong>EDIT 1</strong>
  This is my <code>pod.yml</code> file</p>
  
  <pre><code>---
  apiVersion: v1
  kind: Pod
  metadata:
    name: sample
  spec:
    serviceAccountName: vault-auth
  
    restartPolicy: Never
  
    # Add the ConfigMap as a volume to the Pod
    volumes:
      - name: vault-token
        emptyDir:
          medium: Memory
      # Populate the volume with config map data
      - name: config
        configMap:
          # `name` here must match the name 
          # specified in the ConfigMap's YAML
          # -&gt; kubectl create configmap vault-cm --from-file=./vault-configs/
          name: vault-cm
          items:
            - key : vault-agent-config.hcl
              path: vault-agent-config.hcl
            - key : envconsul.hcl
              path: envconsul.hcl
  
    initContainers:
      # Vault container
      - name: vault-agent-auth
        image: vault
  
        volumeMounts:
          - name: vault-token
            mountPath: /home/vault
          - name: config
            mountPath: /etc/vault
  
        # This assumes Vault running on local host and K8s running in Minikube using VirtualBox
        env:
          - name: VAULT_ADDR
            value: http://10.0.2.2:8200
  
        # Run the Vault agent
        args:
          [
            "agent",
            "-config=/etc/vault/vault-agent-config.hcl",
            "-log-level=debug",
          ]
  
    containers:
      - name: python
        image: myappimg
        imagePullPolicy: Never
        ports:
          - containerPort: 5000
        volumeMounts:
          - name: vault-token
            mountPath: /home/vault
          - name: config
            mountPath: /etc/envconsul
        env:
          - name: HOME
            value: /home/vault
          - name: VAULT_ADDR
            value: http://10.0.2.2:8200
  
  </code></pre>