I read in the envconsul documentation this:

For additional security, tokens may also be read from the environment using the CONSUL_TOKEN or VAULT_TOKEN environment variables respectively. It is highly recommended that you do not put your tokens in plain-text in a configuration file.

So, I have this envconsul.hcl file:

# the settings to connect to vault server
# "http://10.0.2.2:8200" is the Vault's address on the host machine when using Minikube
vault {
  address = "${env(VAULT_ADDR)}"
  renew_token = false
  retry {
    backoff = "1s"
  }
  token = "${env(VAULT_TOKEN)}"
}
# the settings to find the endpoint of the secrets engine
secret {
    no_prefix = true
    path = "secret/app/config"
}

However, I get this error:

[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Get $%7Benv%28VAULT_ADDR%29%7D/v1/secret/app/config: unsupported protocol scheme "" (retry attempt 1 after "1s")

As I understand it, it cannot do the variable substitution.
I tried to set "http://10.0.2.2:8200" and it works.

The same happens with the VAULT_TOKEN var.
If I hardcode the VAULT_ADDR, then I get this error:

[WARN] (view) vault.read(secret/app/config): vault.read(secret/app/config): Error making API request.

URL: GET http://10.0.2.2:8200/v1/secret/app/config
Code: 403. Errors:

* permission denied (retry attempt 2 after "2s")

Is there a way for this file to understand the environmental variables?

EDIT 1 This is my pod.yml file

---
apiVersion: v1
kind: Pod
metadata:
  name: sample
spec:
  serviceAccountName: vault-auth

  restartPolicy: Never

  # Add the ConfigMap as a volume to the Pod
  volumes:
    - name: vault-token
      emptyDir:
        medium: Memory
    # Populate the volume with config map data
    - name: config
      configMap:
        # `name` here must match the name 
        # specified in the ConfigMap's YAML
        # -> kubectl create configmap vault-cm --from-file=./vault-configs/
        name: vault-cm
        items:
          - key : vault-agent-config.hcl
            path: vault-agent-config.hcl
          - key : envconsul.hcl
            path: envconsul.hcl

  initContainers:
    # Vault container
    - name: vault-agent-auth
      image: vault

      volumeMounts:
        - name: vault-token
          mountPath: /home/vault
        - name: config
          mountPath: /etc/vault

      # This assumes Vault running on local host and K8s running in Minikube using VirtualBox
      env:
        - name: VAULT_ADDR
          value: http://10.0.2.2:8200

      # Run the Vault agent
      args:
        [
          "agent",
          "-config=/etc/vault/vault-agent-config.hcl",
          "-log-level=debug",
        ]

  containers:
    - name: python
      image: myappimg
      imagePullPolicy: Never
      ports:
        - containerPort: 5000
      volumeMounts:
        - name: vault-token
          mountPath: /home/vault
        - name: config
          mountPath: /etc/envconsul
      env:
        - name: HOME
          value: /home/vault
        - name: VAULT_ADDR
          value: http://10.0.2.2:8200