Module 6: Kubernetes ConfigMaps & Secrets

In modern applications, separating configuration data and sensitive information from the application code is a best practice. Kubernetes provides two important resources for this: ConfigMaps and Secrets.

This module will cover:

• What are ConfigMaps?

• What are Secrets?

• When to use ConfigMaps vs. Secrets

• How to create & use them in pods

• Real-world best practices

---

🔹 1. What is a ConfigMap?

• A ConfigMap is an API object used to store non-confidential configuration data in key-value pairs.

• Example: database connection string, app settings, feature flags.

• ConfigMaps allow you to keep environment-specific configuration separate from container images.

👉 Benefits:

• Reusable across pods.

• Keeps code and configuration separate.

• Easy updates without redeploying applications.

---

🔹 2. What is a Secret?

• A Secret is similar to a ConfigMap but designed to hold sensitive information such as:

  • Passwords

  • API keys

  • TLS certificates

• Data inside Secrets is base64 encoded (not encrypted by default, but can be encrypted at rest).

👉 Benefits:

• Prevents exposing sensitive data in plain text.

• Can be mounted into pods as environment variables or files.

• Kubernetes RBAC helps restrict access.

---

🔹 3. ConfigMap vs. Secret

---

🔹 4. Creating a ConfigMap

Example: YAML definition

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_MODE: "production"
  LOG_LEVEL: "debug"

Apply it:

kubectl apply -f configmap.yaml

Use it in a Pod:

apiVersion: v1
kind: Pod
metadata:
  name: configmap-pod
spec:
  containers:
    - name: myapp
      image: nginx
      envFrom:
        - configMapRef:
            name: app-config

---

🔹 5. Creating a Secret

Example: YAML definition

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  DB_USER: YWRtaW4=      # base64 for "admin"
  DB_PASSWORD: cGFzc3dvcmQ=   # base64 for "password"

Apply it:

kubectl apply -f secret.yaml

Use it in a Pod:

apiVersion: v1
kind: Pod
metadata:
  name: secret-pod
spec:
  containers:
    - name: myapp
      image: mysql:5.7
      env:
        - name: MYSQL_USER
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_USER
        - name: MYSQL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_PASSWORD

---

🔹 6. Best Practices

✅ Keep Secrets encrypted at rest using KMS (AWS KMS, GCP KMS, Vault). ✅ Do not commit Secrets to GitHub or version control. ✅ Use RBAC to limit access. ✅ Use ConfigMaps for environment configs, Secrets only for sensitive data.

---

✅ Conclusion

• Use ConfigMaps for general application configuration.

• Use Secrets for sensitive data.

• Together, they make Kubernetes apps more secure, portable, and manageable.

---