ConfigMap is used to store non-sensitive configuration data, and Secret is used to store sensitive information. Both manage data through key-value pairs and mount it into a pod, but Secret stores data in Base64 encoding by default and requires additional protection. ConfigMap can be used to store database connection strings, function switches or configuration files, etc., and can be created through literals, files or directories, and mounted as environment variables or volume files. Secret is suitable for sensitive data such as passwords, API keys or TLS certificates, and can also be mounted as environment variables or files, but its data is not encrypted. It is recommended to combine encrypted data at rest or external tools to enhance security. When using it, you should avoid hard-code sensitive information in YAML, and pay attention to the permission control and update that you need to manually restart the pod to take effect changes.

In Kubernetes, ConfigMaps and Secrets are two core resources used to manage configuration data and sensitive information separately from application code. They help keep your deployments clean, secure, and easier to maintain.

What Are ConfigMaps?

ConfigMaps are used to store non-sensitive configuration data in key-value pairs. This can include things like feature flags, environment variables, or configuration files that your app needs to run but aren't tied directly to the container image.

For example:

• Database connection strings (if not sensitive)
• Feature toggle settings
• Application config files like app.conf or settings.json

You can create a ConfigMap from literal values, files, or even directories. Then, you can mount it into a Pod either as environment variables or as files in a volume.

Some ways to use ConfigMaps:

• Pass configuration as environment variables to containers
• Mount config files via volumes for apps that read from disk

This makes it easy to change configurations without rebuilding images.

What Are Secrets?

Secrets work similarly to ConfigMaps, but they're meant for sensitive data. Examples include:

• Passwords
• API keys
• TLS certificates

By default, Secret data is stored as base64-encoded strings. While this isn't encryption (so don't rely on it for high-security environments), it does separate sensitive values ??from application code and Pod specs.

Like ConfigMaps, you can mount Secrets into Pods as environment variables or files.

Important note:
Even though Secrets are encoded, they're not encrypted by default. If you need stronger security, you should enable encryption at rest or use external secret management tools like HashiCorp Vault or AWS Secrets Manager.

How Do You Use Them in Practice?

Let's say you have a web app that connects to a database.

• The database host and port might go into a ConfigMap
• The username and password would go into a Secret

Then, when defining your Deployment or Pod spec, you reference those values:

 env:
  - name: DB_HOST
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: db_host
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: app-secrets
        key: db_password

Or if you're using volume mounts:

 volumeMounts:
  - name: config
    mountPath: /etc/config
Volumes:
  - name: config
    configMap:
      name: app-config

A Couple of Gotchas

• Don't hardcode secrets in YAML files. Always refer to them through the Secret object.
• Be careful with permissions. Anyone who can read Pods or access logs might see environment variables.
• Base64 encoding ≠ encryption. Treat Secrets carefully and consider additional protections if needed.
• Update behavior. If you update a ConfigMap or Secret, existing Pods won't automatically pick up the changes. You'll usually need to restart them.

Basically that's it. ConfigMaps and Secrets give you a clean way to manage both regular and sensitive configuration data in Kubernetes—just make sure you understand how they work and what their limitations are.

The above is the detailed content of What are ConfigMaps and Secrets in Kubernetes?. For more information, please follow other related articles on the PHP Chinese website!