Kubernetes·Kubernetes from first pod to production app

ConfigMaps and Secrets

Separate configuration from images and inject it as env or files.

Intermediate 13 min read Lesson 5 of 300 Challenge included

What you will be able to do

Keep images environment-agnostic.
Use ConfigMaps for non-secret values.
Use Secrets for credentials.
Prefer file mounts for larger configuration.

In plain English

ConfigMaps hold non-sensitive configuration; Secrets hold sensitive values. Both can be mounted as files or injected as environment variables. Secrets are base64-encoded, not encrypted by default, so enable encryption at rest.

config.yamlYAML

apiVersion: v1
kind: ConfigMap
metadata:
  name: web-config
data:
  APP_ENV: production
  LOG_LEVEL: info
---
apiVersion: v1
kind: Secret
metadata:
  name: web-secret
type: Opaque
stringData:
  DATABASE_URL: postgres://app:secret@db:5432/app

Your turn

Inject an environment variable

Medium

Add an env var APP_ENV from a ConfigMap key named APP_ENV.

YAML · starter

env: []

Check your understanding before moving on.

Knowledge checkQuestion 1

Are Kubernetes Secrets encrypted by default?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Ingress

Lesson 5 of 300 · 0% of course