Hands-on Lab·Certified Kubernetes Administrator
ConfigMaps and Secrets
Four ways to hand configuration to a container, and the one difference that catches everyone: patch a ConfigMap and the mounted file updates while the environment variable does not. Also what "encoded" really means for a Secret, and what a missing key looks like.
Configuration and Secrets Guide 34 of 103 Beginner
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 35 min
- Reviewed21 August 2026
Written against the versions above. Timestamps in the projected volume's directory names are generated per run. Everything else here is reproducible.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A working cluster and
kubectl. - The Pods guide. Both of these are consumed by a Pod spec, so that is the shape you need to be comfortable with.
- A willingness to read the update-behaviour step slowly. It is the part that causes real incidents.
-
A ConfigMap is a map, and values can be files
-
A Secret is a ConfigMap that is base64 and nothing more
-
Four ways to consume them, in one Pod
-
How a projected volume is actually built
-
The asymmetry that causes incidents
-
What a missing key looks like
-
Clean up