Kubernetes ConfigMaps and Secrets: Managing Configuration Safely

מאגר מידע

Hardcoding configuration values and credentials directly into container images or Deployment YAML is inflexible and risky. ConfigMaps and Secrets let you manage configuration separately from your application code.

ConfigMaps: Non-Sensitive Configuration

Use ConfigMaps for configuration that isn't sensitive — feature flags, non-secret URLs, log levels, and similar settings.

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-app-config
data:
  LOG_LEVEL: "info"
  API_URL: "https://api.example.com"

kubectl apply -f configmap.yaml

Secrets: Sensitive Configuration

Use Secrets for passwords, API keys, and tokens. Values are base64-encoded (not encrypted by default, though this can be configured at the cluster level) but kept separate from application code and version control.

kubectl create secret generic my-app-secret \
  --from-literal=DB_PASSWORD=CHANGE_ME_STRONG_PASSWORD \
  --from-literal=API_KEY=your_api_key_here

Using a ConfigMap as Environment Variables

spec:
  containers:
  - name: my-app
    image: my-app:latest
    envFrom:
    - configMapRef:
        name: my-app-config

Using a Secret as Environment Variables

spec:
  containers:
  - name: my-app
    image: my-app:latest
    envFrom:
    - secretRef:
        name: my-app-secret

Referencing a Single Specific Value

env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: my-app-secret
      key: DB_PASSWORD

Mounting a ConfigMap as a File (Instead of Environment Variables)

volumes:
- name: config-volume
  configMap:
    name: my-app-config
containers:
- name: my-app
  volumeMounts:
  - name: config-volume
    mountPath: /etc/config

Useful when your application expects a configuration file rather than environment variables.

Creating a ConfigMap from a File

kubectl create configmap my-app-config --from-file=app-config.yaml

Updating a ConfigMap or Secret

kubectl edit configmap my-app-config

Note: existing Pods don't automatically pick up ConfigMap/Secret changes injected as environment variables — you'll typically need to restart the Deployment (kubectl rollout restart deployment my-app) for changes to take effect.

Security Considerations for Secrets

Restrict access to Secrets using Kubernetes RBAC — not every user/service account needs to read every Secret
Consider enabling encryption at rest for Secrets at the cluster (etcd) level for genuinely sensitive data
Never commit raw Secret YAML files (with actual values) to version control — use tools designed for this (like Sealed Secrets or external secret managers) if you need to version-control secret definitions

Common Errors

Environment variable not appearing in the container — verify the ConfigMap/Secret name referenced in the Deployment matches exactly, and that the Pod was restarted after the ConfigMap/Secret was created.

"secret not found" error when creating a Pod — the Secret must exist in the same namespace as the Pod referencing it.

Continue Reading

Browse more articles in Kubernetes & Container Orchestration.

מאגר מידע

קטגוריות

קטגוריות