ConfigMaps & Secrets

0 / 15 lessons — 0%

Lesson 06 / 15

Baking a database URL or an API key straight into a container image means rebuilding the image every time a value changes — and it means that value now lives in your image registry forever. ConfigMaps and Secrets pull configuration out of the image and inject it at runtime instead.


# configmap.yaml — plain-text config
apiVersion: v1
kind: ConfigMap
metadata:
  name: web-config
data:
  LOG_LEVEL: "info"
  FEATURE_FLAG_NEW_UI: "true"


# secret.yaml — same idea, base64-encoded (not encrypted by default!)
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  password: cGFzc3dvcmQxMjM=


# wiring them into a pod as environment variables
spec:
  containers:
    - name: web
      image: myregistry/web:1.5.0
      envFrom:
        - configMapRef:
            name: web-config
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: password

Secrets aren't encrypted by default — that base64 string decodes with one command, it's encoding, not encryption. Anyone with API access to read Secrets can read them in plain text unless you've set up encryption at rest or an external secrets manager (Vault, AWS Secrets Manager, etc.).

Try it yourselfRun echo cGFzc3dvcmQxMjM= | base64 -d in a terminal. That's the entire "encryption" a default Secret gives you — worth knowing before you trust it with anything sensitive.

← Lesson 05 Next: Lesson 07 →