Guides

Kubernetes ConfigMaps और Secrets उदाहरणों के साथ

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

ConfigMap non-secret, Secret sensitive, envFrom/volume inject, rollout restart.

Language: English · मराठी · हिंदी

Image से config अलग क्यों

एक image, कई env.

Why: LOG_LEVEL के लिए rebuild. What: CM+Secret. How: apply.

Example 1: ConfigMap from literals

Type this:

printf '%s\n' 'kubectl create configmap app-config --from-literal=LOG_LEVEL=info --from-literal=FEATURE_X=on --dry-run=client -o yaml' > /tmp/cm-cmd.txt && cat /tmp/cm-cmd.txt

You will see:

kubectl create configmap app-config --from-literal=LOG_LEVEL=info --from-literal=FEATURE_X=on --dry-run=client -o yaml

What it means: Dry-run prints YAML without changing the cluster.

Example 2: ConfigMap YAML

Type this:

printf '%s\n' 'apiVersion: v1' 'kind: ConfigMap' 'metadata:' '  name: app-config' 'data:' '  LOG_LEVEL: info' '  FEATURE_X: "on"' > /tmp/cm.yaml && cat /tmp/cm.yaml

You will see:

kind: ConfigMap

What it means: Non-secret settings live here.

Example 12: Difference one-liner

Type this:

printf '%s\n' 'ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)'

You will see:

ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)

What it means: Interviews ask this exact line.

Concept 1: Secrets

Passwords.

Why: git में plain = audit fail. What: secretKeyRef. How: base64 ≠ encryption.

Example 3: Secret YAML (demo values only)

Type this:

printf '%s\n' 'apiVersion: v1' 'kind: Secret' 'metadata:' '  name: app-secret' 'type: Opaque' 'stringData:' '  DB_PASSWORD: demo-only-not-real' > /tmp/sec.yaml && grep kind /tmp/sec.yaml

You will see:

kind: Secret

What it means: stringData lets you type plain text; API stores base64. Still not for git with real passwords.

Example 5: secretKeyRef one key

Type this:

printf '%s\n' 'env:' '  - name: DB_PASSWORD' '    valueFrom:' '      secretKeyRef:' '        name: app-secret' '        key: DB_PASSWORD' > /tmp/secref.txt && cat /tmp/secref.txt

You will see:

secretKeyRef:

What it means: Mount only the keys the process needs.

Example 9: Never commit real secrets

Type this:

printf '%s\n' 'ok: use sealed-secrets or an external secret store in real teams'

You will see:

ok: use sealed-secrets or an external secret store in real teams

What it means: Plain Secret YAML in git is a finding at Accenture audits.

Example 10: base64 demo (not for real passwords)

Type this:

printf '%s' 'demo' | base64

You will see:

ZGVtbw==

What it means: Opaque secrets store base64 — encoding is not encryption.

Concept 2: Inject

envFrom/volume.

Why: गलत path. What: app जो पढ़ता है. How: get/describe.

Example 4: envFrom ConfigMap

Type this:

printf '%s\n' 'envFrom:' '  - configMapRef:' '      name: app-config' > /tmp/envfrom.txt && cat /tmp/envfrom.txt

You will see:

envFrom:

What it means: All keys become environment variables in the container.

Example 6: Volume mount ConfigMap file

Type this:

printf '%s\n' 'volumeMounts:' '  - name: cfg' '    mountPath: /etc/app' 'volumes:' '  - name: cfg' '    configMap:' '      name: app-config' > /tmp/volcm.txt && head -3 /tmp/volcm.txt

You will see:

volumeMounts:

What it means: Some apps read files under /etc instead of env.

Example 7: get and describe

Type this:

printf '%s\n' 'kubectl get cm app-config && kubectl describe secret app-secret'

You will see:

kubectl get cm app-config && kubectl describe secret app-secret

What it means: describe on Secret hides values — good default.

Concept 3: Rotate

Restart के बिना पुराना env.

Why: Live edit भ्रम. What: rollout restart. How: RBAC.

Example 8: Rollout after change

Type this:

printf '%s\n' 'kubectl rollout restart deploy/web'

You will see:

kubectl rollout restart deploy/web

What it means: Pods do not always reload env until restarted.

Example 11: Immutable tip

Type this:

printf '%s\n' 'immutable: true  # optional lock so nobody patches live'

You will see:

immutable: true  # optional lock so nobody patches live

What it means: Flipkart-style safety for rare config.

Example 12: Difference one-liner

Type this:

printf '%s\n' 'ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)'

You will see:

ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)

What it means: Interviews ask this exact line.

Config/Secret card

1 CM 2 Secret 3 inject 4 restart 5 no real passwords in git

Suppose: old config

Restart.

Suppose: secret in git

Rotate.

Check yourself (quiz)

CM/Secret → inject → restart. Did you understand? Let us try it once more.