ConfigMaps and Secrets

Exam tasks: 2.2 (use ConfigMaps and Secrets to configure applications)

The decision: should this setting reach the container as an environment variable or as a file, and what do you have to do after changing it so the app actually sees the new value?

Env var or volumeCopy Anchor Link

Creating themCopy Anchor Link

k create cm vane-settings -n wx --from-literal=LOG_LEVEL=debug --from-literal=REGION=north
k create cm vane-files -n wx --from-file=app.ini            # key = app.ini
k create cm vane-files2 -n wx --from-file=config.ini=app.ini # key renamed to config.ini
k create cm vane-env -n wx --from-env-file=vane.env          # each KEY=value line becomes a key

k create secret generic vane-db -n wx --from-literal=DB_USER=vane --from-literal=DB_PASS='s3cr3t!'
k create secret tls vane-tls -n wx --cert=tls.crt --key=tls.key
k create secret docker-registry vane-pull -n wx \
  --docker-server=registry.wx.example --docker-username=ci --docker-password='p4ss'

• Quote values with shell metacharacters (!, $) in single quotes, or the shell rewrites them.
• In YAML, Secret data values must be base64; stringData takes plain text and the API server encodes it. Use echo -n when you encode by hand, or the trailing newline ends up in the password.
• ConfigMaps and Secrets are namespaced, and the Pod must be in the same namespace to use them.

Consuming themCopy Anchor Link

apiVersion: v1
kind: Pod
metadata:
  name: vane
  namespace: wx
spec:
  imagePullSecrets:
  - name: vane-pull
  containers:
  - name: vane
    image: registry.wx.example/vane:3.2
    env:
    - name: DATABASE_USER             # name inside the container
      valueFrom:
        secretKeyRef:
          name: vane-db
          key: DB_USER
    envFrom:
    - configMapRef:
        name: vane-settings           # every key becomes a variable
      prefix: CFG_                    # optional: CFG_LOG_LEVEL, CFG_REGION
    volumeMounts:
    - name: conf
      mountPath: /etc/vane            # directory: refreshes on change
      readOnly: true
    - name: tls
      mountPath: /etc/vane/tls
      readOnly: true
  volumes:
  - name: conf
    configMap:
      name: vane-files
      items:                          # optional: only these keys, renamed
      - key: app.ini
        path: vane.ini
  - name: tls
    secret:
      secretName: vane-tls            # note: secretName, not name
      defaultMode: 0400

• The volume field is configMap.name but secret.secretName. Mixing them up is the most common YAML error on this topic.
• A missing ConfigMap or key keeps the Pod in ContainerCreating or CreateContainerConfigError. Add optional: true to the reference if the app can start without it.
• A volume mount replaces the target directory's contents. Mounting into /etc hides everything else in /etc; use a dedicated directory or subPath.
• Secret volumes are backed by tmpfs on the node, so they never hit the node's disk.
• projected volumes merge several ConfigMaps, Secrets, the downward API and ServiceAccount tokens into one directory.

Immutable ConfigMaps and SecretsCopy Anchor Link

apiVersion: v1
kind: ConfigMap
metadata:
  name: vane-settings-v4
data:
  LOG_LEVEL: info
immutable: true

• Once immutable: true is set, data can't change and the flag can't be removed. To change it, create a new object (often with a version suffix) and point the workload at it, which also triggers a rollout.
• Immutable objects aren't watched by kubelets, which cuts API server load in clusters with many Pods.

ScenariosCopy Anchor Link

DrillCopy Anchor Link

kubectl config use-context drill-w2. In namespace kiosk:

1. Create ConfigMap kiosk-ui with keys THEME=dark and LANG=fi.
2. Create Secret kiosk-api with key token set to tk-55aa21.
3. Create Pod kiosk (image busybox:1.36, command sleep 3600) that gets every key of kiosk-ui as env vars and mounts kiosk-api read-only at /run/kiosk.

kubectl config use-context drill-w2
k create ns kiosk --dry-run=client -o yaml | k apply -f -
k create cm kiosk-ui -n kiosk --from-literal=THEME=dark --from-literal=LANG=fi
k create secret generic kiosk-api -n kiosk --from-literal=token=tk-55aa21
k run kiosk -n kiosk --image=busybox:1.36 --dry-run=client -o yaml -- sleep 3600 > kiosk.yaml

spec:
  containers:
  - name: kiosk
    image: busybox:1.36
    args: ["sleep", "3600"]
    envFrom:
    - configMapRef:
        name: kiosk-ui
    volumeMounts:
    - name: api
      mountPath: /run/kiosk
      readOnly: true
  volumes:
  - name: api
    secret:
      secretName: kiosk-api

k apply -f kiosk.yaml
k exec -n kiosk kiosk -- env | grep -E 'THEME|LANG'   # THEME=dark, LANG=fi
k exec -n kiosk kiosk -- cat /run/kiosk/token          # tk-55aa21

Further readingCopy Anchor Link

• ConfigMaps
• Secrets
• Configure a Pod to use a ConfigMap
• Encrypting confidential data at rest