ConfigMaps and Secrets

ConfigMaps and Secrets

Configuration lives in the environment, not in the image. Same image in dev and prod - only the ConfigMap differs.

graph LR CM[ConfigMap app-cfg] -->|env var| P[Pod] SEC[Secret db-cred] -->|env var| P CM -->|mounted file| P
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-cfg
data:
  DATACENTER: dc01
  app.properties: |
    color=blue

env:                                   # one key as a variable
  - name: DATACENTER
    valueFrom:
      configMapKeyRef: { name: app-cfg, key: DATACENTER }
envFrom:                               # all keys as variables
  - configMapRef: { name: app-cfg }
volumes:                               # all keys as files
  - name: cfg
    configMap: { name: app-cfg }
Consumed asChange visible in a running Pod?
mounted fileyes, after ~1 min (not with subPath)
environment variableno - kubectl rollout restart

Secret

Same shape, different intent. Values are base64 - encoding, not encryption.

kubectl create secret generic db-cred \
  --from-literal=username=app --from-literal=password=S3cret
kubectl get secret db-cred -o jsonpath='{.data.password}' | base64 -d
TypeUse
Opaqueanything (default)
kubernetes.io/tlscertificate + key (kubectl create secret tls)
kubernetes.io/dockerconfigjsonregistry credentials (imagePullSecrets)

immutable: true protects a ConfigMap or Secret from edits and saves API load. Never commit real Secrets to Git. Protection comes from RBAC and encryption at rest - Day 4.

References