Configuration should change independently from a container image, but it still needs ownership, validation and a safe delivery path. ConfigMaps hold non-confidential data and Secrets hold confidential values, yet neither automatically solves rotation, encryption or reload behavior.

This guide explains when to use each object, how Pods consume values, why volumes and environment variables behave differently, and which controls turn a convenient API into a production-ready configuration system.

What you will learn

  • Use ConfigMaps for non-confidential settings and Secrets for sensitive values.
  • Secret values require encryption at rest and strict RBAC; base64 is only encoding.
  • Environment variables are simple but usually need a restart to pick up changes.
  • Versioned immutable configuration makes rollout and rollback deterministic.

Choose the correct object

ConfigMaps store settings such as feature flags, hostnames and application files. Secrets are intended for passwords, tokens, keys and certificates. Base64 in a Secret manifest is reversible encoding, not encryption.

Keep large binaries and application artifacts outside both objects. Give every setting an owner, expected format and safe default, and validate configuration before it reaches production.

Environment variables versus files

Environment variables are convenient for small values, but running processes do not automatically receive updates. Values can also appear in debugging output depending on the environment.

Mounted files suit structured configuration and can update with propagation delay, but the application must reload them. Do not assume a file update changes process behavior, and remember that subPath mounts have different refresh behavior.

envFrom:
  - configMapRef:
      name: api-config
volumeMounts:
  - name: credentials
    mountPath: /var/run/app-secrets
    readOnly: true
volumes:
  - name: credentials
    secret:
      secretName: api-credentials

Protect Secret data end to end

Enable API-data encryption at rest and protect encryption keys. Restrict get, list and watch on Secrets. Treat Pod creation in sensitive namespaces as powerful because it may allow indirect credential access.

Do not commit plain Secret manifests. GitOps can use an external secret manager, encrypted values or an operator. Choose a model the team can audit, rotate and restore. Redact values from logs and CI output.

Prefer workload identity

Use cloud workload identity when available. It exchanges Pod identity for short-lived credentials and removes long-lived cloud keys from Kubernetes storage.

Apply the principle to databases and services supporting federation or dynamic credentials. Revoking a trust relationship then stops new credentials without hunting copied values across namespaces.

Version configuration for rollouts

A Deployment does not roll automatically when a referenced ConfigMap changes. Add a content hash to the Pod template or generate versioned object names so a reviewed change creates a new ReplicaSet.

Immutable objects prevent accidental in-place edits. Create a new version, update the workload reference, observe the rollout and retain enough history for rollback before garbage collection.

Rotate without outage

When possible, overlap credentials: issue the new value, deploy consumers, verify adoption, revoke the old value, then confirm nothing still depends on it.

Monitor authentication failures and rollout health. Maintain an emergency rotation runbook for leaked credentials. A secret system is only production-ready when rotation is fast, safe and repeatable.

Production checklist

  • Keep confidential values out of ConfigMaps, Git, images and logs.
  • Enable encryption at rest and restrict Secret RBAC.
  • Document whether applications reload files or require rollout.
  • Use immutable or versioned objects and Pod-template hashes.
  • Prefer workload identity and short-lived credentials.
  • Test routine and emergency rotation with rollback.

Frequently asked questions

Is base64 encryption?

No. It is reversible encoding. Use authorization, encryption at rest and careful delivery.

Will updating a ConfigMap restart a Deployment?

No. Trigger a Pod-template change or use a controller. Mounted files may update, but the application must reload them.

Should every secret live in Kubernetes?

No. External secret managers and workload identity can reduce stored long-lived credentials.

Continue learning Kubernetes

Official Kubernetes references