Dockerfile and container gets ENV from k8s Statefulset

I need to process the ENV from k8s Statefulset in the container before it starts up. Dockerfile:

RUN echo CREDENTIALS: $CREDENTIALS
ARG user="${CREDENTIALS%/*}"
ARG password="${CREDENTIALS#*/}"
ENV USER $user
ENV PASSWORD $password

Statefulset environment:

          env:
            - name: CREDENTIALS
              valueFrom:
                secretKeyRef:
                  name: app-secret
                  key: CREDENTIALS

When I run with d run -dt -e CREDENTIALS="user/P@$$w0rd" myimage:latest, the PASSWORD is missing.

You misunderstand how Dockerfile ARG and ENV work. These values are all baked into the container image at build time. You need to modify your container's entry point to split $CREDENTIALS into separate USER and PASSWORD variables, for example with a small script:

#!/bin/sh
export USER="${CREDENTIALS%/*}"
export PASSWORD="${CREDENTIALS#*/}"
exec /actual/command "$@"