Configuration and secrets

Key points

• Build one artifact and configure it per environment. Same image everywhere means what you tested is what ships.
• Environment variables override anything: SPRING_DATASOURCE_URL sets spring.datasource.url via relaxed binding.
• Defaults live in application.yml inside the jar. Environment-specific values live in the platform: ConfigMap, env vars, Vault.
• Kubernetes Secrets are base64, not encryption. Encrypt etcd at rest or use a real secret manager. Never commit passwords.
• Need a change without a redeploy? Spring Cloud Config plus @RefreshScope. Otherwise just restart; restarts are cheap.

Example

apiVersion: v1
kind: ConfigMap
metadata:
  name: orders-config
data:
  SPRING_PROFILES_ACTIVE: prod
  INVENTORY_BASE_URL: http://inventory
  SPRING_HTTP_CLIENT_READ_TIMEOUT: 2s      # maps to spring.http.client.read-timeout
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders
spec:                                      # (selector and labels trimmed)
  template:
    spec:
      containers:
        - name: app
          image: registry.example.com/orders:1.4.2   # same image in every env
          envFrom:
            - configMapRef:
                name: orders-config
            - secretRef:
                name: orders-secrets       # DB password lives here, never in git

Build once, configure per environment, and keep secrets out of the image and out of git.