Kubernetes ConfigMap and Secret explained

ConfigMap

What is ConfigMap and when is it used? 🤔
Think of it as a properties file for your application. For example depending on your application environment (dev, int, prod) you will have a different database url or logging level. So for these kind of things you can use configMap.

The biggest advantage is that, with properties file, every time you modify it you have to rebuild and redeploy your application, whereas if you change configuration in configMap, you just need to restart the application pod/container.

ConfigMap can be used by the application as a set of environmental variable values or as an actual configuration file.

Example ConfigMap with database connection configuration:

apiVersion: v1 kind: ConfigMap metadata: name: my-config data: db-host: cluster-mysql.database db-port: 3306 db-name: my-db 

The values in this configMap can be used in a following way in your app's pod specification:

apiVersion: v1 kind: Pod metadata: name: my-app spec: containers: - name: my-app image: my-app-image env: - name: DB_HOST valueFrom: configMapKeyRef: name: my-config key: db-host - name: DB_PORT valueFrom: configMapKeyRef: name: my-config key: db-port - name me: DB_NAME valueFrom: configMapKeyRef: name: my-config key: db-name 

Here is an example ConfigMap which creates a configuration file for Mosquitto app:

apiVersion: v1 kind: ConfigMap metadata: name: mosquitto-config data: mosquitto.conf | log_dest stout log_type all log_timestamp true listener 9001 

In this case we need to mount the ConfigMap as a volume in Kubernetes:

apiVersion: v1 kind: Pod metadata: name: mosquitto spec: containers: - name: mosquitto image: mosquitto-image volumeMounts: - name: config-file mountPath: /mosquitto/config volumes: - name: config-file configMap: name: mosquitto-config 

This config map will produce a file mosquitto.conf, which then can be mounted into the Mosquitto container under /mosquitto/config directory.

Secret

Secrets 🔐 are also used in these 2 ways. Either as a value for env variables or as a secret file with credentials or a certificate etc mounted into a pod.

So for a better comparison, think of secrets as encrypted configMaps.

Example secret with key-value pairs:

apiVersion: v1 kind: Secret metadata: name: my-secret type: Opaque data: db-user: dXNlcg== db-password: cGFzc3dvcmQ 

And you can use it the same way as ConfigMap in your application's configuration file:

apiVersion: v1 kind: Pod metadata: name: my-app spec: containers: - name: my-app image: my-app-image env: - name: DB_USER valueFrom: secretKeyRef: name: my-secret key: db-user - name: DB_PASSWORD valueFrom: secretKeyRef: name: my-secret key: db-password 

Here is an example secret that creates a file:

apiVersion: v1 kind: Secret metadata: name: my-secret type: Opaque data: cacert.pem | base-64-encoded value of a PEM certificate 

And again, just like with ConfigMap, you will need to mount this secret as a volume into the pod to use the cacert.pem file:

apiVersion: v1 kind: Pod metadata: name: my-app spec: containers: - name: my-app image: my-app-image volumeMounts: - name: certificate-file mountPath: /etc/secret volumes: - name: certificate-file configMap: name: my-secret 

The inconvenience with this way of creating a secret for a file is that you will have to base64 encode the file contents and then paste it into the data section.

So an easier alternative way to create secrets from a file is with kubectl command.

Like in the above case, get the cacert.pem file and execute:

kubectl create secret generic my-secret --from-file=./cacert.pem 

Thanks for reading 👩🏻‍💻 and click on ❤️ or 🦄 if you learned something. 🤓

You can follow me on Twitter and YouTube.

More about Kubernetes Components: