ConfigMaps and Secrets

Configuration and Secrets / Guide 34 of 103 / Beginner

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 35 min

Timestamps in the projected volume's directory names are generated per run. Everything else here is reproducible.

This guide includes

Use this when configuration has to reach a container and you are choosing how. This matters because the four mechanisms behave differently when the value changes - one of them never updates until the Pod restarts - and a Secret is base64 rather than encryption.

• writing a ConfigMap whose values are whole files, and seeing that a Secret is only base64
• consuming both of them four ways inside a single Pod, so nothing else can explain the difference
• looking inside a projected volume and finding symlinks rather than plain files
• patching a ConfigMap and watching the mounted file change while the environment variable does not
• referencing a key that does not exist, and finding where the Pod actually stops

Before you start

• A working cluster and kubectl.
• The Pods guide. Both of these are consumed by a Pod spec, so that is the shape you need to be comfortable with.
• A willingness to read the update-behaviour step slowly. It is the part that causes real incidents.

1. 1

   A ConfigMap is a map, and values can be files

2. 2

   A Secret is a ConfigMap that is base64 and nothing more

3. 3

   Four ways to consume them, in one Pod

4. 4

   How a projected volume is actually built

5. 5

   The asymmetry that causes incidents

6. 6

   What a missing key looks like

7. 7

   Clean up

Official sources

• ConfigMaps
• Secrets
• Configure a pod to use a ConfigMap
• Encrypting confidential data at rest