We have setup the base of our helm-charts and now we require to set up an external secret named “SecretStore” that needs to be exposed as environment variables so my spring boot app can use it.
There has been no issue in retrieving the secret using kubectl -n default get secrets.
I have referred this secret in my deployment.yaml and helm-release.yaml but it is not fetched properly. when i do a describe deployment i get the env variable as

Environment:
DEMO_ENVRIONMENT: sit
ENCRYPT_RANDOM_DELAY_ENABLED: false
M_USERNAME: map[secretKeyRef:map[key:musername name:common-credential-store]]

The files are as below

values.yaml

# Default values for helm-guestbook.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicas: 2
nameOverride: webclient-hw-v1
service:
  type: ClusterIP
  port: 80
  targetPort: 8087
  mappings:
  - path: /api/hw-v1
    name: hw-v1-default
    host: "app-1526272-hellow.sdpamp.com"    
linkerd:
  inject: 
    enabled: true
  profile:
    enabled: true
autoscaling:
  min: 2
  max: 8
  cpuUsage: 15
canary:
  enabled: false
  helmtest:
    enabled: false
    url: http://flagger-helmtester.operations/
  loadtest:
    enabled: true
    url: http://flagger-loadtester.operations/
  analysis:
    interval: 60s
    threshold: 10
    maxWeight: 15
    stepWeight: 3
  thresholds:
    successRate: 99
    latency: 200
env:
  ENCRYPT_RANDOM_DELAY_ENABLED: "false"
  DEMO_ENVRIONMENT: "sit"
secrets:
  common:
    name: common-credential-store
    key: mtoken
  api:
    name: common-credential-store
    key: musername

Deloyment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "helm-chart.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ template "helm-chart.fullname" . }}
  annotations:
    linkerd.io/inject: "{{ .Values.linkerd.inject.enabled }}"
    config.linkerd.io/proxy-cpu-request: "100m"
    config.linkerd.io/proxy-memory-request: "100Mi"
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "helm-chart.fullname" . }}
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "helm-chart.fullname" . }}
      annotations:
        linkerd.io/inject: "{{ .Values.linkerd.enabled }}"
        config.linkerd.io/proxy-cpu-request: "100m"
        config.linkerd.io/proxy-memory-request: "100Mi"
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
      - name: encrypt-microservice
        # example ECR link below, replace with yours.
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        # image: <ECR_LINK>/sample-encryption-ms:1.0
        env:
          {{- range $key, $val := .Values.secrets }}
          - name: {{ $key }}
            {{- if $val.name}}
            valueFrom:
              secretKeyRef:
                name: {{ $val.name }}
                key: {{ $val.key }}
            {{- end}}
          {{- end}}

          {{- range $key, $val := .Values.env }}
            - name: {{ $key }}
              value: {{ $val | quote }}
          {{- end }}
        resources:
          requests:
            cpu: 100m
            memory: 32M
        ports:
        - name: http
          containerPort: 8087

Helm-Release.yaml

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: hw-v1
spec:
  values:
    image:
      repository: harbor.tools.default.com/maglev/hw-v1
      tag: 0.0.34-12451257 # {"$imagepolicy": "operations:encrypt-dev:tag"}
    imagePullSecrets:
      - name: common-credential-store
    service:
      mappings:
      - path: /api/hw-v1/
        name: hw-v1-mapping
        host: "app-01526272-hellow.sdpamp.com"
    secrets:
      common:
        name: common-credential-store
        key: mtoken
      api:
        name: common-credential-store
        key: musername
    env:
      ENCRYPT_RANDOM_DELAY_ENABLED: "false"
      DEMO_ENVRIONMENT: "sit"
      M_USERNAME:
        secretKeyRef:
          name: common-credential-store
          key: musername
    autoscaling:
      min: 2
      max: 10
    replicas: 2
    canary:
      enabled: false
      analysis:
        interval: 20s
        maxWeight: 15 # max traffic split in percent
        stepWeight: 3 # slit step in percent
        threshold: 2 # max failed metric checks - 2 intervals
      thresholds:
        successRate: 98 # percent
        latency: 200 # miliseconds
  interval: 1m0s
  chart:
    spec:
      chart: ./charts/hw-v1
      sourceRef:
        kind: GitRepository
        name: hw-v1
        namespace: default

Somehow post git reconciling on my server when i do a describe deployment I can the environment variable as

Environment:
DEMO_ENVRIONMENT: sit
ENCRYPT_RANDOM_DELAY_ENABLED: false
M_USERNAME: map[secretKeyRef:map[key:musername name:common-credential-store]]

Its not fetching the actual value. Can someone help over this