◐/

BROWSE108 notes

Filter notes/

Enter opens the top match. Use /regex/i for patterns.

▸Software Enginner1

▾Kubernetes16

ConfigMaps and Secrets

▸Troubleshooting1

▸GitHub Actions15

Fix bugs or Add features docker system prune curl API testing: repeat 100×, load & timing Install .deb files & alternative install methods (Ubuntu)

⌂Home ◐Search◎Graph

ConfigMaps and Secrets · Knowledge & Memory Center

Kubernetes/Config/ConfigMaps and Secrets

CommandUpdated 3 weeks ago

ConfigMaps and Secrets

Keep configuration out of the image: ConfigMaps for plain settings, Secrets for credentials, injected as environment variables or mounted files.

#kubernetes #config #secrets

Create

From literals and files

SHELL

1kubectl create configmap web-config --from-literal=LOG_LEVEL=info --from-file=app.properties

2kubectl create secret generic db-cred --from-literal=DB_USER=app --from-literal=DB_PASS='s3cr3t'

3kubectl get configmap web-config -o yaml

4kubectl get secret db-cred -o jsonpath='{.data.DB_PASS}' | base64 -d

Use in a pod

env vars + mounted files

YAML

1spec:

2 containers:

3 - name: web

4 envFrom:

5 - configMapRef: { name: web-config }

6 - secretRef: { name: db-cred }

7 volumeMounts:

8 - { name: cfg, mountPath: /etc/app, readOnly: true }

9 volumes:

10 - name: cfg

11 configMap: { name: web-config }

Apply changes

Mounted files update automatically after a short delay; environment variables do not. Restart the workload to pick up new values: kubectl rollout restart deploy/web.

!

Secrets are only base64-encoded, not encrypted. Enable etcd encryption at rest, restrict access with RBAC, and use Sealed Secrets, External Secrets or Vault when manifests live in Git.

On this page

Create Use in a pod Apply changes

Referenced by0

Leads to

History

3 weeksEdited "ConfigMaps and Secrets"