ConfigMap, Secret, projected volume, envFrom, and secure configuration patterns.
Store non-confidential config and mount or inject it.
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
data:
APP_ENV: production
LOG_LEVEL: info
FEATURE_X_ENABLED: "true"ConfigMaps store non-confidential data in key-value form and can be consumed as env vars, args, or files.
Mount application config files from YAML.
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-config
data:
default.conf: |
server {
listen 80;
location / {
proxy_pass http://api:8080;
}
}Expose configuration under a volume mount path.
volumes:
- name: app-config
configMap:
name: nginx-config
containers:
- name: nginx
image: nginx:1.27
volumeMounts:
- name: app-config
mountPath: /etc/nginx/conf.dStore sensitive values and mount or inject them securely.
Author readable Secret YAML without manual base64.
apiVersion: v1
kind: Secret
metadata:
name: app-secrets
type: Opaque
stringData:
DATABASE_URL: postgres://app:secret@postgres:5432/app
API_KEY: replace-meUse `stringData` in YAML authoring; the API server handles encoding into Secret data fields.
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: app-secrets
key: DATABASE_URLvolumes:
- name: tls
secret:
secretName: app-tls
containers:
- name: api
volumeMounts:
- name: tls
mountPath: /etc/tls
readOnly: truekubectl create secret generic app-secrets --from-literal=API_KEY=replace-meMerge multiple sources into one mount.