ConfigMaps & Secrets
Manage configuration data and sensitive information securely within your Kubernetes deployments using ConfigMaps and Secrets.
ConfigMaps & Secrets is a free Docker & DevOps Fundamentals lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Docker & DevOps Fundamentals learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Intro to ConfigMaps & Secrets
Welcome! In this lesson, we'll learn how to manage configuration data and sensitive information in Kubernetes. We'll explore ConfigMaps and Secrets, two essential tools for flexible and secure application deployments.
Why Externalize Config?
Imagine hardcoding database credentials or API keys directly into your application's Docker image. This makes updates difficult and exposes sensitive data.
- Inflexibility: Changes require rebuilding the image.
- Security Risk: Sensitive data is baked into the image.
- Environment Specific: Different environments (dev, prod) need different settings.
ConfigMaps: Non-Sensitive Data
A ConfigMap is a Kubernetes object used to store non-sensitive configuration data as key-value pairs. Think of it as a central place for your app's settings, like log levels or API endpoints.
It decouples configuration from your application code, making your deployments more portable and easier to manage.
Define a ConfigMap
You can create a ConfigMap from literal values, files, or directories. Here's a simple example defined in a YAML file:
apiVersion: v1
kind: ConfigMap
metadata:
name: my-app-config
data:
log_level: "INFO"
api_endpoint: "http://myapi.example.com"ConfigMap as Environment Variables
Once created, a Pod can consume ConfigMap data as environment variables. This is a common way to pass settings to your application.
Here's how a Pod uses our my-app-config:
apiVersion: v1
kind: Pod
metadata:
name: configmap-env-pod
spec:
containers:
- name: my-container
image: busybox
command: ["sh", "-c", "echo Log Level: $LOG_LEVEL; echo API: $API_ENDPOINT"]
env:
- name: LOG_LEVEL
valueFrom:
configMapKeyRef:
name: my-app-config
key: log_level
- name: API_ENDPOINT
valueFrom:
configMapKeyRef:
name: my-app-config
key: api_endpoint
restartPolicy: NeverConfigMap as Mounted Files
Alternatively, ConfigMap data can be mounted as files inside your container. Each key-value pair becomes a file, with the key as the filename and the value as the content.
This is useful for configuration files that your application expects to read from a specific path.
apiVersion: v1
kind: Pod
metadata:
name: configmap-file-pod
spec:
containers:
- name: my-container
image: busybox
command: ["sh", "-c", "cat /etc/config/log_level; cat /etc/config/api_endpoint"]
volumeMounts:
- name: config-volume
mountPath: /etc/config
volumes:
- name: config-volume
configMap:
name: my-app-config
restartPolicy: NeverSecrets: Sensitive Data
Secrets are similar to ConfigMaps but are designed for sensitive data like passwords, API keys, or TLS certificates. Kubernetes helps you manage and distribute them securely.
While ConfigMaps store data in plain text, Secrets are base64-encoded. This is NOT encryption, but it prevents accidental exposure.
Define a Secret
When creating a Secret, the values must be base64 encoded. You can use echo -n 'my-password' | base64 to encode them.
Here's an example for a database password:
apiVersion: v1
kind: Secret
metadata:
name: db-credentials
type: Opaque
data:
username: YWRtaW4= # base64 of 'admin'
password: c3VwZXJzZWNyZXRwYXNz # base64 of 'supersecretpass'Using Secrets in Pods
Secrets are consumed by Pods in much the same way as ConfigMaps: as environment variables or mounted files. Kubernetes will automatically decode them before presenting them to the container.
Using them as mounted files is generally preferred for security, as environment variables can be more easily logged or inspected.
apiVersion: v1
kind: Pod
metadata:
name: secret-env-pod
spec:
containers:
- name: my-app-container
image: busybox
command: ["sh", "-c", "echo DB User: $DB_USERNAME; echo DB Pass: $DB_PASSWORD"]
env:
- name: DB_USERNAME
valueFrom:
secretKeyRef:
name: db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-credentials
key: password
restartPolicy: NeverSecurity Best Practices
Remember, base64 encoding is not encryption. For true encryption at rest, you might need a Kubernetes Secrets backend (like Vault) or leverage cloud provider KMS services.
- RBAC: Control who can access Secrets.
- Least Privilege: Only give Pods access to the Secrets they need.
- Mounted Files: Prefer mounting Secrets as files over environment variables.
Quick Check on Configuration
You need to store an API key (sensitive) and a log level setting (non-sensitive) for your application in Kubernetes.
Which Kubernetes objects should you use for each, respectively?
Recap: ConfigMaps & Secrets
Great job! You've learned how to manage application configuration and sensitive data in Kubernetes.
- ConfigMaps: Store non-sensitive key-value pairs.
- Secrets: Store sensitive data (base64 encoded).
- Both can be consumed as environment variables or mounted files by Pods.
- Always follow security best practices when handling sensitive information.
Next, explore advanced security topics like RBAC and external secret management solutions.
Frequently asked questions
Is the “ConfigMaps & Secrets” lesson free?
Yes — the full text of “ConfigMaps & Secrets” is free to read here on the web, and the Docker & DevOps Fundamentals course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Docker & DevOps Fundamentals course, upgrade to CoddyKit PRO.
What will I learn in “ConfigMaps & Secrets”?
Manage configuration data and sensitive information securely within your Kubernetes deployments using ConfigMaps and Secrets. You practise Docker & DevOps Fundamentals with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Docker & DevOps Fundamentals?
No prior experience is required. Docker & DevOps Fundamentals on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “ConfigMaps & Secrets” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Docker & DevOps Fundamentals lesson?
Yes. Every Docker & DevOps Fundamentals lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.