I have set up google secret manager in my GKE cluster, where my configurations are as follows:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-creds
  namespace: default
spec:
  refreshInterval: 10s          
  secretStoreRef:
    kind: ClusterSecretStore
    name: gcp-store              
SecretStore
  target:
    name: db-creds               
    creationPolicy: Owner
  data:
  - secretKey: db-user                   
    remoteRef:
      key: db-username            
  - secretKey: db-pass               
    remoteRef:
      key: db-password  

and I can succesfully retrieve its values:

kubectl get secret db-creds -n default -o jsonpath='{.data.db-user}’ | base64 -d
user1

{ i took reference from: https://medium.com/google-cloud/secrets-management-using-external-secret-operator-for-goole-secret-manager-on-gke-2e20f38a66bf
}

Now since the db user and password has been created and is accessible by my cluster i want to use it in my deployment.yaml file:
           - name: DB_USER
            valueFrom:
              secretKeyRef:
                name: db-creds
                key: db-username
          - name: DB_PASSWORD
            valueFrom:
              secretKeyRef:
                name: db-creds
                key: db-password
#          envFrom:
#            - secretRef:
#                name: db-creds

     and my configmap.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "xx.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ include "xx.name" . }}
    helm.sh/chart: {{ include "xx.chart" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
data:
  application.properties: |
    grpc.port=xx

{{- if .Values.GRPC_HEADER.enabled -}}
    {{ printf "n" }}
    grpc.client.enable.header=true
    {{ printf "n" }}
    service.mesh.version.routing.header=x-anydone-version:v3
{{- end }}
    environment = {{ .Values.ENVIRONMENT }}
    yy.db.password = ${DB_PASSWORD}
    yy.db.user = ${DB_USER}
    yy.db.driver = com.mysql.cj.jdbc.Driver

but im still getting error in my pod logs:

ink_folder WHERE folder_id = ? 
09:34:09.805  ERROR omcat.jdbc.pool.ConnectionPool - Unable to create initial connections of pool.
java.sql.SQLException: Access denied for user '${DB_USER}'@'zz.zz.zz.zz' (using password: YES)

where did i go wrong? why isnt it referencing the environment variable?

Ive tried to reference it as such as well:

    anydone.db.password = ${db-pass}
    anydone.db.user = ${db-user}

where my deployment file had:

        envFrom:
#            - secretRef:
#                name: db-creds