Step 01 of 06
Learn the concept
Images should be boringly identical across environments. The knobs belong outside. Kubernetes gives you two boxes for those knobs, one for ordinary data and one for sensitive data that is only sensitive if you treat it that way.
The ideas this is made of
ConfigMaps hold ordinary configuration
A ConfigMap stores non-secret data: listen addresses, feature flags, probe intervals, target lists and file content. It is namespaced and versioned through the API server like other objects. It is not for passwords. The value is convenience and separation: one image can run in several environments because its behavior comes from mounted files or environment variables.
Secrets are base64, not encrypted by default
A Kubernetes Secret looks safer than a ConfigMap, but its data is merely base64 encoded in the manifest format. That prevents broken YAML, not disclosure. Real protection comes from API access control, encryption at rest configured on the cluster, careful logging and never committing real credentials. For this local course, use fake values only.
Environment variables do not live-update
When Kubernetes starts a container, it constructs the environment once. If the referenced ConfigMap changes later, the process environment does not change. Mounted ConfigMap volumes are different: kubelet refreshes projected files eventually, usually within about a minute. The process still has to re-read the file, so live update is not automatic application behavior.
Checksum annotations make config changes rollout deliberately
A common production pattern is to put a hash of configuration data in the Pod template annotations. When configuration changes, the annotation changes, so the Deployment sees a new Pod template and rolls Pods. Kubernetes does not calculate that checksum for you; Helm, Kustomize or a small script usually does. The point is explicit restart, not surprise magic.
printed menu changes on the wall
staff can read the new page
a receipt already printed does not changeMounted files can change for future reads. Environment variables are more like the receipt: copied once at process start. Kubernetes will not edit a running process's memory because a ConfigMap changed.
ConfigMap, Secret, env and file
| Choice | Best for | Gotcha |
|---|---|---|
ConfigMap | Non-sensitive config | Size and text shape matter |
Secret | Credentials or tokens | Base64 is not encryption |
Env var | Simple startup knobs | Never updates in running process |
Mounted file | Config files and lists | App must re-read or restart |
Checksum annotation | Controlled restarts | You must update the hash |
What these are called on the job
ConfigMap — A namespaced object storing non-secret key/value data or file content.
Secret — A namespaced object intended for sensitive values, access-controlled by the API and encoded as base64 in manifests.
Projection — Kubernetes making object data available inside a Pod as files or environment variables.
Checksum annotation — A Pod template annotation derived from config content to trigger rollouts when config changes.