ConfigMaps, Secrets & Env

ConfigMaps, Secrets & Env

Step 1 of 11

One image, every environment. The settings live beside it, in objects the Pod reads when it starts.

The Idea

Keep configuration out of the image. A ConfigMap holds non-confidential key-value data; a Secret holds small sensitive values such as passwords and tokens. A Pod consumes either as environment variables or as files in a mounted volume.

Real-World Example

The same api image runs in staging and production. LOG_LEVEL comes from a ConfigMap; the database password comes from a Secret, mounted read-only as a file. Promoting a release changes config objects, never the image.

The Tradeoff

Secret values are base64-encoded, not encrypted, and by default sit unencrypted in etcd: enable encryption at rest and restrict access with RBAC. Environment variables are fixed when the container starts; mounted files update eventually, except through subPath.

Hands-On

# illustrative — a ConfigMap and a Secret from the command line
kubectl create configmap api-config --from-literal=LOG_LEVEL=info
kubectl create secret generic api-db --from-literal=password=change-me

# illustrative — in the Pod template
containers:
  - name: api
    envFrom: [{ configMapRef: { name: api-config } }]
    volumeMounts: [{ name: db, mountPath: /etc/db, readOnly: true }]
volumes:
  - { name: db, secret: { secretName: api-db } }

Your turn

Put the steps in the right order.

1. 1Reference them from the Pod template: envFrom and a secret volume↑↓
2. 2The kubelet starts the container with the variables and the mounted file↑↓
3. 3Create the ConfigMap and the Secret↑↓
4. 4To change LOG_LEVEL, update the ConfigMap and roll the Deployment↑↓

Check order

Mini quiz

1 / 3

A Secret's data field is:

• AEncrypted with a cluster key by default
• BBase64-encoded, and stored unencrypted in etcd unless encryption at rest is enabled
• CHashed so no one can read it back
• DKept only in the Pod's memory

Sources

• ConfigMaps — Kubernetes Documentation
• Secrets — Kubernetes Documentation
• Good practices for Kubernetes Secrets — Kubernetes Documentation