ConfigMaps and Secrets

Introduction #

Understanding the role of ConfigMaps and Secrets in Kubernetes.

What is a ConfigMap? #

A ConfigMap is a Kubernetes object used to store non-sensitive configuration data as key-value pairs. It separates configuration data from application code, making applications easier to manage and more portable.

What is a Secret? #

A Secret is a Kubernetes object similar to a ConfigMap, but intended to store sensitive data such as passwords, API keys or certificates. Its values are stored base64-encoded, which is not protection: anyone who can read the object can decode the value. Protection relies on RBAC (who can read Secrets) and on encryption at rest in etcd (EncryptionConfiguration, or encryption managed by the cloud provider).

How ConfigMaps work #

How to use and manage ConfigMaps in Kubernetes.

Creating a ConfigMap #

A ConfigMap can be created from the command line or from a YAML file.

kubectl create configmap my-config --from-literal=key1=value1 --from-literal=key2=value2

Using a ConfigMap #

ConfigMaps can be mounted into a Pod as environment variables or as volumes:

Mounting as environment variables:

env:
  - name: CONFIG_KEY
    valueFrom:
      configMapKeyRef:
        name: my-config
        key: key1

Mounting as a volume:

volumes:
  - name: config-volume
    configMap:
        name: my-config
volumeMounts:
  - name: config-volume
    mountPath: /etc/config

ConfigMap YAML example #

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
  namespace: default
data:
  key1: value1
  key2: value2

How Secrets work #

How to use and manage Secrets in Kubernetes.

Creating a Secret #

A Secret can be created from the command line or from a YAML file. With kubectl create secret, you pass the values in plain text: kubectl encodes them in base64 itself.

kubectl create secret generic my-secret --from-literal=username=myuser --from-literal=password=mypassword

Using a Secret #

Secrets can be used as environment variables or mounted as volumes:

Mounting as environment variables:

env:
  - name: SECRET_KEY
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: username

Mounting as a volume:

volumes:
  - name: secret-volume
    secret:
        secretName: my-secret
volumeMounts:
  - name: secret-volume
    mountPath: /etc/secret

Secret YAML example #

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
data:
  username: bXl1c2Vy
  password: bXlwYXNzd29yZA==

In YAML: data or stringData #

In a manifest, data expects values that are already base64-encoded, whereas stringData accepts plain text (Kubernetes encodes it on write):

apiVersion: v1
kind: Secret
metadata: { name: my-secret }
type: Opaque
stringData:
  username: myuser
  password: mypassword

Common mistake: Never commit a plain-text Secret manifest: use Sealed Secrets, SOPS or External Secrets Operator to store secrets encrypted in Git or in a vault.

Differences between ConfigMaps and Secrets #

Compare ConfigMaps and Secrets to choose the right one for your needs.

Stored data #

ConfigMaps: non-sensitive data such as configuration files or environment variables.
Secrets: sensitive data such as passwords or private keys.

Data encoding #

ConfigMaps: plain-text data.
Secrets: base64-encoded data, which is not encryption; enable etcd encryption at rest and restrict read access with RBAC.

Security #

ConfigMaps: no additional protection.
Secrets: access controlled by RBAC; using external secret management tools such as HashiCorp Vault is recommended for stronger security.

Best practices #

Tips for managing ConfigMaps and Secrets optimally.

Use namespaces #

Organize your ConfigMaps and Secrets by namespace for better isolation and management.

Restrict access #

Apply strict RBAC policies to restrict access to Secrets.

Use secret management tools #

Integrate solutions such as HashiCorp Vault or AWS Secrets Manager to strengthen the security of sensitive data.

Avoid storing secrets in plain text #

Never store Secrets directly in files or in container images.

Conclusion #

Why ConfigMaps and Secrets matter.

ConfigMaps and Secrets are essential Kubernetes tools for managing application configuration and protecting sensitive data. Used well, they improve the modularity, security and maintainability of Kubernetes deployments. By applying best practices and using the right management tools, you can ensure a secure, high-performing Kubernetes environment.