Kubernetes

Day 6: ConfigMaps & Secrets — Managing App Settings and Sensitive Data in Kubernetes

Let’s Begin With What You Might Know

In traditional apps — whether Node.js, Python, Java, or others — you’ve probably done this before:

DB_USERNAME=admin  
DB_PASSWORD=1234  
APP_ENV=production

.env files
Docker run commands
Cloud config panels

And sometimes… you (accidentally or lazily) hardcode passwords into the code itself. 😬

But in Kubernetes, there’s a better and safer way to do this.

Enter: ConfigMaps and Secrets

What’s a ConfigMap?

A ConfigMap is used to store non-sensitive configuration data like:

Environment variables
App settings
File paths
Feature flags

It keeps your app configs separate from your app code and container image — which is great for flexibility and security.

What’s a Secret?

A Secret is like a ConfigMap — but for sensitive data:

Passwords
API tokens
TLS certificates
Private keys

Secrets are base64-encoded and can be managed with tighter access controls in Kubernetes.

Why Use Them?

Without ConfigMaps/Secrets	With ConfigMaps/Secrets
Hardcoded values	Clean separation of config from code
Rebuilding images for every config change	Update values without touching the image
Risky to expose sensitive data	Secrets are encoded and more secure
Poor reusability	Reuse configs across multiple apps easily

How It Works

You:

Create a ConfigMap or Secret
Attach it to your Pod using:
- Environment variables
- Mounted volumes
Your app reads the values from the injected location

Example: Creating a ConfigMap

kubectl create configmap app-config \
  --from-literal=APP_ENV=production \
  --from-literal=FEATURE_X=true

And a Secret:

kubectl create secret generic db-secret \
  --from-literal=DB_USER=admin \
  --from-literal=DB_PASS=1234

Then, in your Pod spec (simplified YAML):

env:
  - name: APP_ENV
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_ENV
  - name: DB_USER
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: DB_USER

Try It Yourself

👉 Use the KodeKloud Kubernetes Playground

1 - Create a Secret:

kubectl create secret generic mysecret \
  --from-literal=password=mypass123

2 - Create a Pod using that secret:

apiVersion: v1
kind: Pod
metadata:
  name: secret-demo
spec:
  containers:
  - name: busybox
    image: busybox
    command: ["sleep", "3600"]
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mysecret
          key: password

Apply it with:

kubectl apply -f pod.yaml
kubectl exec -it secret-demo -- printenv DB_PASSWORD

You’ll see the password securely injected.

Real-World Analogy

Imagine you’re deploying an app on a shared team server.

Hardcoding passwords in the app = leaving your house key in plain sight
Using ConfigMaps and Secrets = storing your keys in a locked drawer with access logs