Chapter 75: DevOps Projects Part 5: Kubernetes Cluster Deploy Ingress TLS HPA Probes StatefulSet Blue-Green

75.3 Project 33: ConfigMaps and Secrets for app config

By Ravindra Bagale Last updated: 28 October 2026

Friends, config must not live inside the image. Today we put APP_ENV in a ConfigMap, DB_PASSWORD in a Secret, mount both into a Pod, and prove the values with printenv.

What you will build in this project

ConfigMap shop-config with APP_ENV.
Secret shop-secret with DB_PASSWORD.
Deployment envFrom both.
printenv proves values inside the Pod.

1. Start from a real company story

At TCS in Mumbai, a payment image baked the DB password into a layer. The password leaked when someone shared the image tar.

Security paused the release. Rough cost: about ₹22 lakh in audit overtime and a delayed go-live.

Ananya moved config to a ConfigMap and secrets to a Secret with envFrom. Images stayed clean.

Today we practice that ConfigMap and Secret pattern.

Picture 1: image stays clean; config comes from objects

Ravindra Bagale's Tip

Many students put passwords in ConfigMaps because it is easier. ConfigMaps are not encrypted at rest by default. Passwords belong in Secrets. Keep that habit.

2. Start and prepare

Step 1: Create ConfigMap

Why: ConfigMap for plain config. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl create configmap. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: cm

Type this:

kubectl delete configmap shop-config --ignore-not-found >/dev/null 2>&1; kubectl create configmap shop-config --from-literal=APP_ENV=stage --from-literal=APP_REGION=mumbai && kubectl get cm shop-config

You will see:

configmap/shop-config created
NAME DATA AGE
shop-config 2 0s

What it means: ConfigMap with two plain keys.

Example 2: cm data

Type this:

kubectl get cm shop-config -o jsonpath='{.data.APP_ENV}'; echo

You will see:

stage

What it means: APP_ENV is stage.

Example 3: cm yaml

Type this:

kubectl get cm shop-config -o yaml | grep -A2 data:

You will see:

data:
  APP_ENV: stage
  APP_REGION: mumbai

What it means: Plain text in ConfigMap data.

Step 2: Create Secret

Why: Secret for passwords. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl create secret. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: sec

Type this:

kubectl delete secret shop-secret --ignore-not-found >/dev/null 2>&1; kubectl create secret generic shop-secret --from-literal=DB_PASSWORD='s3cure-Lab-Only' && kubectl get secret shop-secret

You will see:

secret/shop-secret created
NAME TYPE DATA AGE
shop-secret Opaque 1 0s

What it means: Opaque Secret with one key.

Example 5: keys

Type this:

kubectl get secret shop-secret -o jsonpath='{.data}' ; echo

You will see:

{"DB_PASSWORD":"czNjdXJlLUxhYi1Pbmx5"}

What it means: Value stored as base64, not plain.

Example 6: decode

Type this:

kubectl get secret shop-secret -o jsonpath='{.data.DB_PASSWORD}' | base64 -d; echo

You will see:

s3cure-Lab-Only

What it means: Decode proves the original lab password.

Step 3: Write Deployment with envFrom

Why: envFrom keeps YAML short. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf deploy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: deploy

Type this:

mkdir -p /tmp/k8s33 && printf '%s\n' 'apiVersion: apps/v1' 'kind: Deployment' 'metadata: {name: cfg-demo}' 'spec:' '  replicas: 1' '  selector: {matchLabels: {app: cfg-demo}}' '  template:' '    metadata: {labels: {app: cfg-demo}}' '    spec:' '      containers:' '      - name: app' '        image: busybox:1.36' '        command: ["sh","-c","sleep 3600"]' '        envFrom:' '        - configMapRef: {name: shop-config}' '        - secretRef: {name: shop-secret}' > /tmp/k8s33/deploy.yaml && grep -A3 envFrom /tmp/k8s33/deploy.yaml

You will see:

envFrom:
- configMapRef: {name: shop-config}
- secretRef: {name: shop-secret}

What it means: Deployment pulls both objects via envFrom.

Example 8: apply

Type this:

kubectl apply -f /tmp/k8s33/deploy.yaml

You will see:

deployment.apps/cfg-demo created

What it means: Deployment applied.

Example 9: wait

Type this:

kubectl wait --for=condition=available deploy/cfg-demo --timeout=90s

You will see:

deployment.apps/cfg-demo condition met

What it means: Pod Available.

3. Build the main pieces

Step 4: Apply and wait Ready

Why: apply creates the Pod. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl apply and wait. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: pod

Type this:

kubectl get pods -l app=cfg-demo -o name

You will see:

pod/cfg-demo-...

What it means: Pod name for exec.

Example 11: ready

Type this:

kubectl get pods -l app=cfg-demo -o jsonpath='{.items[0].status.phase}'; echo

You will see:

Running

What it means: Phase Running.

Example 12: env count

Type this:

kubectl exec deploy/cfg-demo -- printenv | wc -l

You will see:

What it means: Many env vars including ours.

Step 5: printenv APP_ENV

Why: APP_ENV from ConfigMap. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl exec printenv. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: app env

Type this:

kubectl exec deploy/cfg-demo -- printenv APP_ENV

You will see:

stage

What it means: ConfigMap value visible as env.

Example 14: region

Type this:

kubectl exec deploy/cfg-demo -- printenv APP_REGION

You will see:

mumbai

What it means: Second ConfigMap key also present.

Example 15: missing

Type this:

kubectl exec deploy/cfg-demo -- sh -c 'printenv NOPE || echo absent'

You will see:

absent

What it means: Unknown keys are absent.

Step 6: printenv DB_PASSWORD

Why: password from Secret. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl exec printenv. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: pass

Type this:

kubectl exec deploy/cfg-demo -- printenv DB_PASSWORD

You will see:

s3cure-Lab-Only

What it means: Secret value injected as env.

Example 17: not in image

Type this:

kubectl exec deploy/cfg-demo -- ls / | head -3

You will see:

bin
dev
etc

What it means: Busybox rootfs has no baked password file.

Example 18: why

Type this:

echo 'Image stays reusable across stage and prod; only objects change'

You will see:

Image stays reusable across stage and prod; only objects change

What it means: Why envFrom beats baking config.

4. Automate and verify

Step 7: Show Secret is base64

Why: etcd stores base64. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl get secret -o yaml. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: base64 note

Type this:

kubectl get secret shop-secret -o yaml | grep DB_PASSWORD

You will see:

DB_PASSWORD: czNjdXJlLUxhYi1Pbmx5

What it means: YAML shows base64 only.

Example 20: not encryption

Type this:

echo 'base64 is encoding, not encryption; enable encryption at rest on the API server in real clusters'

You will see:

base64 is encoding, not encryption; enable encryption at rest on the API server in real clusters

What it means: Security habit.

Example 21: rbac tip

Type this:

echo 'Limit who can get secrets with RBAC in later projects'

You will see:

Limit who can get secrets with RBAC in later projects

What it means: RBAC preview.

Step 8: Rotate Secret

Why: rotate updates the object. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl apply secret. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: rotate

Type this:

kubectl create secret generic shop-secret --from-literal=DB_PASSWORD='rotated-Lab-99' --dry-run=client -o yaml | kubectl apply -f -

You will see:

secret/shop-secret configured

What it means: Secret object updated with new value.

Example 23: old pod

Type this:

kubectl exec deploy/cfg-demo -- printenv DB_PASSWORD

You will see:

s3cure-Lab-Only

What it means: Running Pod still has the old env until restart.

Example 24: why stale

Type this:

echo 'env values are fixed at container start; rollout to reload'

You will see:

env values are fixed at container start; rollout to reload

What it means: Why restart is required.

Step 9: Rollout restart

Why: restart reloads env. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl rollout restart. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: restart

Type this:

kubectl rollout restart deploy/cfg-demo && kubectl rollout status deploy/cfg-demo --timeout=90s

You will see:

deployment "cfg-demo" successfully rolled out

What it means: New Pod started after restart.

Example 26: new pass

Type this:

kubectl exec deploy/cfg-demo -- printenv DB_PASSWORD

You will see:

rotated-Lab-99

What it means: New Secret value is live.

Example 27: env still

Type this:

kubectl exec deploy/cfg-demo -- printenv APP_ENV

You will see:

stage

What it means: ConfigMap value unchanged.

5. Harden and accept

Step 10: Prove new value

Why: new value visible. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printenv again. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: describe

Type this:

kubectl get deploy cfg-demo -o yaml | grep -A6 envFrom

You will see:

envFrom:
        - configMapRef:
            name: shop-config
        - secretRef:
            name: shop-secret

What it means: Wiring still present after rollout.

Example 29: cm intact

Type this:

kubectl get cm shop-config -o jsonpath='{.data.APP_REGION}'; echo

You will see:

mumbai

What it means: ConfigMap untouched by Secret rotate.

Example 30: vol tip

Type this:

echo 'For files instead of env, use volume mounts from configMap and secret'

You will see:

For files instead of env, use volume mounts from configMap and secret

What it means: Alternate pattern tip.

Step 11: File mount tip

Why: files for long config. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: volumeMount tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: file mount tip

Type this:

printf '%s\n' 'volumeMount tip: mountPath /etc/cfg from configMap shop-config' > /tmp/k8s33/vol-tip.txt && cat /tmp/k8s33/vol-tip.txt

You will see:

volumeMount tip: mountPath /etc/cfg from configMap shop-config

What it means: File-mount pattern written for notebooks.

Example 32: secret file tip

Type this:

echo 'secret volumeMode gives files under /etc/secrets without env leakage in process lists'

You will see:

secret volumeMode gives files under /etc/secrets without env leakage in process lists

What it means: When files beat env.

Example 33: choose

Type this:

echo 'Use env for simple flags; use files for long config and certs'

You will see:

Use env for simple flags; use files for long config and certs

What it means: Decision tip.

Step 12: Acceptance checklist

Why: Ananya signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: list

Type this:

kubectl get cm shop-config secret shop-secret deploy cfg-demo

You will see:

NAME ...
shop-config 2
shop-secret Opaque 1
cfg-demo 1/1

What it means: All three objects present.

Example 35: cleanup tip

Type this:

echo 'Optional cleanup: kubectl delete deploy cfg-demo cm shop-config secret shop-secret'

You will see:

Optional cleanup: kubectl delete deploy cfg-demo cm shop-config secret shop-secret

What it means: Cleanup command for later.

Example 36: Sign-off

Type this:

echo 'Ananya: PASS'

You will see:

Ananya: PASS

What it means: Project 33 accepted.

Check yourself

Q1. Who fixed TCS leak?

Ananya

Q2. Non-secret object?

ConfigMap

Q3. Sensitive object?

Secret

Q4. Inject field?

envFrom

Q5. Prove command?

printenv

Q6. APP_ENV value?

stage

Friends, you injected ConfigMap and Secret values into a Pod. Did you understand? Let us try it once more. Rotate the Secret value and restart the Deployment to pick it up.

Lab: try at home

Create ConfigMap.
Create Secret from literal.
Wire envFrom on Deployment.
Prove with printenv.
Rotate Secret and rollout.

Recap

ConfigMaps hold non-secret config.
Secrets hold sensitive values.
envFrom injects all keys.
Pods do not see Secret updates until restart.
Never bake passwords into images.