> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Use secret environment variables

Astro [environment variables](/docs/astro/environment-variables) marked as secrets are stored in a Kubernetes secret called `env-secrets`. To use a secret value in a task running on the Kubernetes executor, you pull the value from `env-secrets` and mount it to the Pod running your task as a new Kubernetes Secret.

## Setup

<Steps>
  <Step title="Add import to your dag file">
    Add the `Secret` import to your dag file:

    ```python wrap theme={null}
    from airflow.kubernetes.secret import Secret
    ```
  </Step>

  <Step title="Define a Kubernetes secret">
    Define a Kubernetes `Secret` in your dag instantiation using the following format:

    ```python wrap theme={null}
    secret_env = Secret(deploy_type="env", deploy_target="<VARIABLE_KEY>", secret="env-secrets", key="<VARIABLE_KEY>")
    namespace = conf.get("kubernetes", "NAMESPACE")
    ```
  </Step>

  <Step title="Reference the environment variable key">
    Reference the key for the environment variable, formatted as `$VARIABLE_KEY` in the task using the `KubernetesPodOperator`.
  </Step>
</Steps>

## Example

In the following example, a secret named `MY_SECRET` is pulled from `env-secrets` and printed to logs.

```python wrap theme={null}
import pendulum
from airflow.kubernetes.secret import Secret

from airflow.models import DAG
from airflow.providers.cncf.kubernetes.operators.pod import KubernetesPodOperator
from airflow.configuration import conf

with DAG(
        dag_id="test-kube-pod-secret",
        start_date=pendulum.datetime(2022, 1, 1, tz="UTC"),
        end_date=pendulum.datetime(2022, 1, 5, tz="UTC"),
        schedule="@once",
        catchup=False,
) as dag:

    secret_env = Secret(deploy_type="env", deploy_target="MY_SECRET", secret="env-secrets", key="MY_SECRET")

    namespace = conf.get("kubernetes", "NAMESPACE")

    k = KubernetesPodOperator(
        namespace=namespace,
        image="ubuntu:16.04",
        cmds=["bash", "-cx"],
        arguments=["echo $MY_SECRET && sleep 150"],
        name="test-name",
        task_id="test-task",
        get_logs=True,
        in_cluster=True,
        secrets=[secret_env],
    )
```