Configure with ConfigMaps and Secrets
Externalize model config and credentials.
Configure with ConfigMaps and Secrets is a free MLOps Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MLOps Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Keep Config Out of the Image
Baking model paths or thresholds into the container forces a rebuild for every tweak. Kubernetes lets you inject config at runtime instead. 🔧
ConfigMaps Hold Plain Settings
A ConfigMap stores non-secret key-value pairs: a model name, a batch size, a log level. One config object, many Pods reading from it.
apiVersion: v1
kind: ConfigMap
metadata:
name: model-config
data:
MODEL_NAME: "ranker-v3"
BATCH_SIZE: "32"Inject as Environment Variables
The simplest use is to map ConfigMap keys into env vars. Your Python code then reads os.environ exactly as it would locally.
Or Mount It as Files
You can also mount a ConfigMap as a volume, turning each key into a file. Handy for full config files your model loader expects on disk.
Secrets Are for Sensitive Data
API tokens, database passwords, and registry creds belong in a Secret, never a ConfigMap. Same idea, but treated as confidential by the cluster.
Base64 Is Not Encryption
Secret values are stored base64-encoded, which is just encoding, not security. Anyone with read access can decode them, so guard access carefully.
Encrypt Secrets at Rest
For real protection, enable encryption at rest in etcd or use an external manager like Vault. Base64 alone never keeps your model credentials safe.
Consume a Secret Safely
Mount a Secret as env vars or files just like a ConfigMap. Prefer files for tokens, since env vars can leak into logs and crash dumps.
envFrom:
- secretRef:
name: model-creds
- configMapRef:
name: model-configOne Source, Many Pods
Update a ConfigMap once and every Pod that mounts it can pick up the change. Env-var injections, though, need a Pod restart to refresh.
Restart to Pick Up Env Changes
Changing a value used as an env var does not hot-reload. Trigger a rolling restart of the Deployment so Pods read the new configuration.
Separate Config per Environment
Keep one ConfigMap per environment, dev and prod. Same image, different config, means promoting a model never means rebuilding the container.
Quick Check
Where should a model service get its database password?
Recap
Use a ConfigMap for plain settings and a Secret for sensitive ones, inject both at runtime, and restart Pods to refresh env-based values. ✅
Frequently asked questions
Is the “Configure with ConfigMaps and Secrets” lesson free?
Yes — the full text of “Configure with ConfigMaps and Secrets” is free to read here on the web, and the MLOps Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MLOps Academy course, upgrade to CoddyKit PRO.
What will I learn in “Configure with ConfigMaps and Secrets”?
Externalize model config and credentials. You practise MLOps Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MLOps Academy?
No prior experience is required. MLOps Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Configure with ConfigMaps and Secrets” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MLOps Academy lesson?
Yes. Every MLOps Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Pods, Deployments, and Services for Models
- Request CPU, Memory, and GPU
- Configure with ConfigMaps and Secrets
- Run Training as a Kubernetes Job