ConfigMaps and Secrets

Build one image and inject settings at run time.

kubectl create configmap app-config --from-literal=LOG_LEVEL=info
kubectl create secret generic db-pass --from-literal=password='S3cret!'

containers:
  - name: app
    image: myapp:1.0
    envFrom:
      - configMapRef: { name: app-config }
    env:
      - name: DB_PASSWORD
        valueFrom:
          secretKeyRef: { name: db-pass, key: password }

Be clear about Secrets: they are base64 encoded, not encrypted, by default. Anyone who can read the Secret object (or etcd) can read the value. Restrict access with RBAC, and enable encryption at rest for etcd or use an external secret store.

Kubernetes 1.21 made immutable ConfigMaps and Secrets generally available: set immutable: true to prevent accidental edits and reduce load on the API server. Changing a mounted ConfigMap updates files eventually, but environment variables only change when pods restart.