Concept of ConfigMap

![[images/截屏2026-03-25 16.16.53.png]]

ConfigMap provides a way to store configuration information and provides it to containers.

Provides a way to inject configuration data into a container.
Can store entire files or provide key-value pairs
- Store in a File.
- Key is the filename, value is the file contents
- Can be JSON, XML, k-v, …

ConfigMap can be accessed from a Pod with:

Environment variables (k-v)
ConfigMap Volume (access as files)

![[images/截屏2026-03-25 16.21.04.png]]

Create ConfigMap

# Create from a ConfigMap mainfest
kubectl create -f [yaml_name.yaml]
# Create a ConfigMap using data from a config file
kubectl create configmap [cm_name] --from-file=[file_path]
# Create a ConfigMap from an env file
kubectl create configmap [cm_name] --from-env-file=[file_path]
# Create a configMap from individual data values
kubectl create configmap [cm_name] --from-literal=[key]=[value]

ConfigMap Mainfest

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-settings
  labels:
    app: app-settings
data:
  enemies: aliens
  lives: "3"
  enemies.cheat: "true"
  enemies.cheat.level: noGoodRotten

![[images/截屏2026-03-25 16.22.31.png]]

kubectl create -f [yaml_name.yaml]

Key-Value Pairs in File

![[images/截屏2026-03-25 16.23.03.png]]

# Create a ConfigMap using adata from a file
kubectl create configmap [cm_name] --from-file=[file_path]

![[images/截屏2026-03-25 16.24.33.png]]

Env File

![[images/截屏2026-03-25 16.27.59.png]]

# Create a env ConfigMap using data from a file
kubectl create configmap [cm_name] --from-env-file=[file_path]

Use ConfigMap

kubectl

# Get a ConfigMap
kubectl get cm [cm_name] -o yaml
kubectl describe cm [cm_name]

Select Keys to Use as Env Vars

Load keys that the Pod needs.

![[images/截屏2026-03-25 16.58.47.png]]

Use All Keys as Env Vars

envFrom can be used to load all ConfigMap keys-values into environment variables.

![[images/截屏2026-03-25 17.01.58.png]]

Mount to Container (Volume)

Each key is converted to a file; value is added into the file

![[images/截屏2026-03-25 17.07.32.png]]

Secret Concept

A Secret is an objec that contains a small amount of sensitive data such as a password, a token, or a key.

Kubernetes can store sensitive information (pwd, keys, certificates, …)
Avoids storing secrets in container images, in files, or in deployment manifests.
Mount secrets into pods as files or as environment variables
Kubernetes only makes secrets available to Nodes that hava a Pod requesting the secret.
Secrets are stored in tmpfs on a Node (not on disk)

Secrets best practices:

Enable encryption at rest for cluster data.
Limit access to etcd (where Secret are stored) to only admin users.
Use SSL/TLS for etcd peer-to-peer communication.
Manifest (YAML/JSON) files only base64 encode the Secret.
Pods can access Secrets so secure which users can create Pods. Role-based access control (RBAC) can be used.

Create Secret

kubectl

# Create a secret and store securly in Kubernetes
kubectl create secret generic [secret_name] --from-literal=[key]=[value]
# Create a secret from a file
kubectl create secret generic [secret_name] --from-file=[key]=[value]
# Create a secret from a key pair
kubectl create secret tls [secret_name] --cert=path/to/tls.cert --key=path/to/tls.key

YAML

For security, any secret data is only base64 encoded in the manifest file. But the file still has the risk of leaking the secret, so it should be careful to store secret in the manifest files.

![[images/截屏2026-03-25 17.52.14.png]]

Use Secret

List Secret Keys

# Get Secrets
kubectl get secrets
# Get YAML for specific secret
kubectl get secrets db-passwords -o yaml

Env Vars

![[images/截屏2026-03-27 13.26.34.png]]

Volumes

Each key is converted to a file. Value is added into the file.

![[images/截屏2026-03-27 13.28.13.png]]

Example

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app: mongo-secrets-env
  name: mongo-secrets-env
data:
  MONGODB_DBNAME: codeWithDan
  MONGO_INITDB_ROOT_USERNAME: admin

---

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: local-storage
provisioner: kubernetes.io/no-provisioner
# The reclaim policy applies to the persistent volumes not the storage class itself.
# pvs and pvcs that are created using that storage class will inherit the reclaim policy set here.
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer

---

# Note: While a local storage PV works, going with a more durable solution (NFS, cloud option, etc.) is recommended
# Adding this for demo purposes to run on Docker Desktop Kubernetes since it only supports a single Node
# https://kubernetes.io/blog/2018/04/13/local-persistent-volumes-beta/
apiVersion: v1
kind: PersistentVolume
metadata:
  name: mongo-pv
spec:
  capacity:
    storage: 1Gi
  volumeMode: Filesystem
  accessModes:
  - ReadWriteOnce
  # StorageClass has a reclaim policy default so it'll be "inherited" by the PV
  # persistentVolumeReclaimPolicy: Retain
  storageClassName: local-storage
  hostPath:
    path: /private/tmp/data/db
    type: DirectoryOrCreate
  nodeAffinity:
    required:
      nodeSelectorTerms:
      - matchExpressions:
        - key: kubernetes.io/hostname
          operator: In
          values:
          - docker-desktop

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mongo-pvc
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: local-storage
  resources:
    requests:
      storage: 1Gi

---

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: mongo
  name: mongo
spec:
  serviceName: mongo
  replicas: 1
  selector:
    matchLabels:
      app: mongo
  template:
    metadata:
      labels:
        app: mongo
    spec:
      volumes:
      - name: mongo-volume
        persistentVolumeClaim:
          claimName: mongo-pvc
        # Example only - environment vars actually used here
      - name: secrets
        secret:
          secretName: db-passwords
      containers:
      - env:
        - name: MONGODB_DBNAME
          valueFrom:
            configMapKeyRef:
              key: MONGODB_DBNAME
              name: mongo-secrets-env
        - name: MONGO_INITDB_ROOT_USERNAME
          valueFrom:
            configMapKeyRef:
              name: mongo-secrets-env
              key: MONGO_INITDB_ROOT_USERNAME
        # Pull password from secrets
        - name: MONGO_INITDB_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-passwords
              key: db-password
        image: mongo
        name: mongo
        ports:
        - containerPort: 27017
        resources: {}
        volumeMounts:
        - name: mongo-volume
          mountPath: /data/db
        # Example only - environment vars actually used here
        - name: secrets
          mountPath: /etc/db-passwords
          readOnly: true