Kubernetes/ConfigMap and Secrets

ConfigMap object allows to manage application's configuration using Kubernetes primitives. YAML below:

kubectl create configmap my-config-map --namespace=web -oyaml --dry-run > config-map.yml

<syntaxhighlightjs lang=yaml> apiVersion: v1 kind: ConfigMap metadata:

 creationTimestamp: null
 name: my-config-map
 namespace: web

data: # added when editing

 myKey: myValue1
 anotherKey: myValue2

</syntaxhighlightjs>

ConfigMap

As a environment	Mounted volume	Secrets mounted volume
<syntaxhighlightjs lang=yaml> apiVersion: v1 kind: Pod metadata: name: kube-configmap spec: containers: - name: nginx image: nginx command: ['sh', '-c', "echo $(VAR) && sleep 600"] env: - name: VAR valueFrom: configMapKeyRef: name: kubeapp-config key: value1 </syntaxhighlightjs>	<syntaxhighlightjs lang=yaml>apiVersion: v1 kind: Pod metadata: name: configmap-volume-kube spec: containers: - name: nginx image: nginx command: ['sh', '-c', "echo $(cat /etc/config/myKey && sleep 3600"] volumeMounts: - name: configmapvolume mountPath: /etc/config # this will be a directory volumes: - name: configmapvolume configMap: # key will be a file name name: kube-configmap # with value in content </syntaxhighlightjs>	<syntaxhighlightjs lang=yaml> apiVersion: v1 kind: Pod metadata: name: kube-secret-volume-pod spec: containers: - name: nginx image: nginx command: ['sh', '-c', "echo $(MY_VAR) && sleep 3600"] volumeMounts: - name: secretvolume mountPath: /etc/certs volumes: - name: secretvolume secret: secretName: kube-secret </syntaxhighlightjs>

Deploy configMap

kubectl apply -f configmap-pod.yaml
kubectl logs configmap-pod         #Get the logs from the pod displaying the value

Another way to provide values from a ConfigMap is to mount as a container's volume. The keys you can see within the container

kubectl exec configmaps-volume-kube -- ls  /etc/config
kubectl exec configmaps-volume-kube -- cat /etc/config/key1

Secrets

Secrets types:

SecretType = "Opaque"                                 // Opaque (arbitrary data; default)
SecretType = "kubernetes.io/service-account-token"    // Kubernetes auth token
SecretType = "kubernetes.io/dockercfg"                // Docker registry auth
SecretType = "kubernetes.io/dockerconfigjson"         // Latest Docker registry auth

Create secrets

kubectl create secret generic user-creds --from-literal=pass=pass123 --from-literal=user=john --save-config  -oyaml --dry-run=true --type=Opaque > secrets.yaml

<syntaxhighlightjs lang=yaml> apiVersion: v1 kind: Secret metadata:

 creationTimestamp: null
 name: user-creds

data: # keys contain b64 encoded values

 pass: cGFzczEyMw==
 user: am9obg==

type: Opaque </syntaxhighlightjs>

Another secret. stringData: specifying non-binary secret data in string form. It is provided as a write-only convenience method. All keys and values are merged into the data field on write. <syntaxhighlightjs lang=yaml> apiVersion: v1 kind: Secret metadata:

 name: kube-secret

stringData: # literal string, keys' values will be b64 encoded on write

 cert: 1234abc
 key: ca.crt

</syntaxhighlightjs>

Describe secrets

kubectl describe secrets kube-secret
Name:         kube-secret
Namespace:    default
Labels:       <none>
Annotations:  
Type:         Opaque

Data
====
cert:  5 bytes
key:   5 bytes

Reference secrets in pod spec

kubectl create secret generic user-creds --from-literal=user=john --from-literal=password=pass123 --save-config -oyaml --type=Opaque  --dry-run=true

ConfigMap

As a environment

Secrets mounted volume

<syntaxhighlightjs lang=yaml> apiVersion: v1 kind: Pod metadata: name: busybox-with-secret-env spec: containers: - name: busybox image: busybox command: ['sh', '-c', "echo secret env(VAR) variable: $VAR && sleep 3600"] env: - name: VAR valueFrom: configMapKeyRef: name: user-creds key: password </syntaxhighlightjs>

<syntaxhighlightjs lang=yaml>apiVersion: v1 kind: Pod metadata: name: busybox-with-secret-mounted spec: containers: - name: busybox image: busybox command: ['sh', '-c', "echo $(cat /etc/config/myKey && sleep 3600"] volumeMounts: - name: configmapvolume mountPath: /etc/config # this will be a directory volumes: - name: secretvolume configMap: # key will be a file name name: user-creds # with value in the content </syntaxhighlightjs>

References

• configure-pod-configmap
• Secretes