ConfigMaps and Secrets

What you will be able to do

• Distinguish configmap content from secret content in a realistic configmaps and secrets case.
• Interpret the operational evidence and boundary associated with volume projection.
• Choose an appropriate action involving environment injection without exceeding the named workload scope.
• Verify rotation boundary through an observable runtime result and reproducible handoff.

01

Frame ConfigMaps and Secrets

Supply application configuration through ConfigMaps and sensitive values through Secrets while controlling projection, refresh, and rotation boundaries.

An API needs a feature flag and database credential. Both are currently embedded in the image, requiring a rebuild for configuration and exposing the password in metadata.

Keep declared state, runtime state, observable evidence, access boundaries, and recovery outcomes separate. Begin with the smallest read-only inspection that identifies the exact image, container, Pod, controller, network, storage object, or policy in scope.

02

ConfigMap content

A ConfigMap stores non-confidential key-value configuration separately from a container image. Within configmaps and secrets, this role answers one specific container or orchestration question and keeps its own evidence.

Move the feature flag into a named ConfigMap with an explicit key. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not place database passwords in a configmap. The observable result is specific: the pod receives the feature flag without rebuilding the image.

03

Secret content

A Secret is intended to hold a small amount of sensitive data for controlled use by workloads. Within configmaps and secrets, this role answers one specific container or orchestration question and keeps its own evidence.

Create the credential through the approved secret-management path. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not assume base64 representation alone encrypts or protects the value. The observable result is specific: only the intended workload identity can request the secret.

04

Volume projection

ConfigMaps and Secrets can be projected into a Pod as files in a mounted volume. Within configmaps and secrets, this role answers one specific container or orchestration question and keeps its own evidence.

Map only required keys to documented file paths. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not mount a broad secret collection when one key is needed. The observable result is specific: the container reads the selected files at the expected paths.

05

Environment injection

Configuration can also enter a container as environment variables when the Pod is created. Within configmaps and secrets, this role answers one specific container or orchestration question and keeps its own evidence.

Choose file or environment delivery according to application behavior. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not expect an existing environment variable to update automatically after source changes. The observable result is specific: a recreated pod receives the new declared value.

06

Rotation boundary

Credential rotation must update the source, workload consumption, and verification without exposing old values. Within configmaps and secrets, this role answers one specific container or orchestration question and keeps its own evidence.

Rotate the database Secret and replace or refresh consumers safely. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not print old or new credentials during verification. The observable result is specific: the api reconnects with the new credential and the old one is revoked.

07

Apply ConfigMaps and Secrets to One Workload

Use one bounded workload decision: An API needs a feature flag and database credential. Both are currently embedded in the image, requiring a rebuild for configuration and exposing the password in metadata.

First, move the feature flag into a named configmap with an explicit key. Then, create the credential through the approved secret-management path. Preserve both observations with the exact resource identity before changing runtime state.

Next, map only required keys to documented file paths. After that, choose file or environment delivery according to application behavior. Close the task only after you rotate the database secret and replace or refresh consumers safely.

08

Recap Before Practice and Prove

ConfigMap content: A ConfigMap stores non-confidential key-value configuration separately from a container image. In this workload, move the feature flag into a named configmap with an explicit key. Preserve the boundary: do not place database passwords in a configmap.

Secret content: A Secret is intended to hold a small amount of sensitive data for controlled use by workloads. In this workload, create the credential through the approved secret-management path. Preserve the boundary: do not assume base64 representation alone encrypts or protects the value.

Volume projection: ConfigMaps and Secrets can be projected into a Pod as files in a mounted volume. In this workload, map only required keys to documented file paths. Preserve the boundary: do not mount a broad secret collection when one key is needed.

Environment injection: Configuration can also enter a container as environment variables when the Pod is created. In this workload, choose file or environment delivery according to application behavior. Preserve the boundary: do not expect an existing environment variable to update automatically after source changes.

Rotation boundary: Credential rotation must update the source, workload consumption, and verification without exposing old values. In this workload, rotate the database secret and replace or refresh consumers safely. Preserve the boundary: do not print old or new credentials during verification.