ConfigMaps and Secrets

Separating Config from Containers

Hard-coding configuration in the image is a bad idea. Kubernetes offers ConfigMap for non-sensitive config and Secret for sensitive values like tokens and passwords.

Creating a ConfigMap

kubectl create configmap app-config \
  --from-literal=env=production \
  --from-literal=logLevel=info
kubectl get configmap app-config -o yaml

Using ConfigMap as Environment Variables

apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  containers:
  - name: app
    image: myapp:1.0
    envFrom:
    - configMapRef:
        name: app-config

Creating a Secret

echo -n 'mysupersecret' | kubectl create secret generic db-pass --from-file=password=/dev/stdin
kubectl get secret db-pass -o yaml

env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: db-pass
      key: password

Secrets are base64-encoded, not encrypted. Enable encryption at rest in a real cluster and use a sealed secret / external secrets manager for sensitive data.

Key Points

• ConfigMap = non-sensitive config; Secret = sensitive data.
• Mount them as env vars or as files in a volume.
• Base64 is not encryption - protect Secrets properly.