Kubernetes YAML Config and Secrets

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: production
  LOG_LEVEL: info
  FEATURE_X_ENABLED: "true"

# Key-value application config in YAML.

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  default.conf: |
    server {
      listen 80;
      location / {
        proxy_pass http://api:8080;
      }
    }

# Mount application config files from YAML.

volumes:
  - name: app-config
    configMap:
      name: nginx-config

containers:
  - name: nginx
    image: nginx:1.27
    volumeMounts:
      - name: app-config
        mountPath: /etc/nginx/conf.d

# Expose configuration under a volume mount path.

apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
stringData:
  DATABASE_URL: postgres://app:secret@postgres:5432/app
  API_KEY: replace-me

# Author readable Secret YAML without manual base64.

env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: app-secrets
        key: DATABASE_URL

# Map one Secret key to one variable.

volumes:
  - name: tls
    secret:
      secretName: app-tls
containers:
  - name: api
    volumeMounts:
      - name: tls
        mountPath: /etc/tls
        readOnly: true

# Expose certificate or key material through a volume.

kubectl create secret generic app-secrets --from-literal=API_KEY=replace-me

# Generate a Secret without hand-editing YAML.

volumes:
  - name: app-settings
    projected:
      sources:
        - configMap:
            name: app-config
        - secret:
            name: app-secrets

# Project multiple sources into a single directory.