ConfigMaps and Secrets

Key points

• Same image in dev and prod. Only the ConfigMap differs. Build once, configure per environment.
• Inject as env vars with envFrom, or mount as files. Env vars freeze at pod start; mounted files refresh within about a minute.
• A Secret is base64, not encryption. Anyone who can read Secrets in that namespace can decode it instantly.
• Turn on encryption at rest for etcd and restrict Secrets with RBAC. That is what actually protects them.
• Write plain text under stringData and the API server does the base64 encoding for you.
• Never commit real Secrets. Use Sealed Secrets, External Secrets or your cloud's secret manager.

Example

apiVersion: v1
kind: ConfigMap
metadata:
  name: web-config
data:
  SPRING_PROFILES_ACTIVE: prod
  APP_PAGE_SIZE: "50"
---
apiVersion: v1
kind: Secret
metadata:
  name: web-secrets
type: Opaque
stringData:                      # plain text in, base64 stored
  SPRING_DATASOURCE_PASSWORD: s3cr3t
---
# in the pod template
spec:
  containers:
    - name: app
      image: ghcr.io/acme/web:1.4.2
      envFrom:
        - configMapRef:
            name: web-config
        - secretRef:
            name: web-secrets

ConfigMaps hold settings. Secrets hold values you still have to protect yourself.