Guides

Kubernetes ConfigMaps and Secrets Explained with Examples

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Put non-secret config in ConfigMaps and sensitive values in Secrets, inject with envFrom or volumes, then rollout restart.

Language: English · मराठी · हिंदी

Why split config from image

Same image, many environments.

Why: Rebuilding images for LOG_LEVEL wastes hours. What: ConfigMap + Secret inject at runtime. How: YAML then apply.

Example 1: ConfigMap from literals

Type this:

printf '%s\n' 'kubectl create configmap app-config --from-literal=LOG_LEVEL=info --from-literal=FEATURE_X=on --dry-run=client -o yaml' > /tmp/cm-cmd.txt && cat /tmp/cm-cmd.txt

You will see:

kubectl create configmap app-config --from-literal=LOG_LEVEL=info --from-literal=FEATURE_X=on --dry-run=client -o yaml

What it means: Dry-run prints YAML without changing the cluster.

Example 2: ConfigMap YAML

Type this:

printf '%s\n' 'apiVersion: v1' 'kind: ConfigMap' 'metadata:' '  name: app-config' 'data:' '  LOG_LEVEL: info' '  FEATURE_X: "on"' > /tmp/cm.yaml && cat /tmp/cm.yaml

You will see:

kind: ConfigMap

What it means: Non-secret settings live here.

Example 12: Difference one-liner

Type this:

printf '%s\n' 'ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)'

You will see:

ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)

What it means: Interviews ask this exact line.

Concept 1: Secrets are sensitive

Passwords and tokens.

Why: Plain secrets in git fail audits. What: stringData / secretKeyRef; external stores later. How: base64 is not encryption.

Example 3: Secret YAML (demo values only)

Type this:

printf '%s\n' 'apiVersion: v1' 'kind: Secret' 'metadata:' '  name: app-secret' 'type: Opaque' 'stringData:' '  DB_PASSWORD: demo-only-not-real' > /tmp/sec.yaml && grep kind /tmp/sec.yaml

You will see:

kind: Secret

What it means: stringData lets you type plain text; API stores base64. Still not for git with real passwords.

Example 5: secretKeyRef one key

Type this:

printf '%s\n' 'env:' '  - name: DB_PASSWORD' '    valueFrom:' '      secretKeyRef:' '        name: app-secret' '        key: DB_PASSWORD' > /tmp/secref.txt && cat /tmp/secref.txt

You will see:

secretKeyRef:

What it means: Mount only the keys the process needs.

Example 9: Never commit real secrets

Type this:

printf '%s\n' 'ok: use sealed-secrets or an external secret store in real teams'

You will see:

ok: use sealed-secrets or an external secret store in real teams

What it means: Plain Secret YAML in git is a finding at Accenture audits.

Example 10: base64 demo (not for real passwords)

Type this:

printf '%s' 'demo' | base64

You will see:

ZGVtbw==

What it means: Opaque secrets store base64 — encoding is not encryption.

Concept 2: Inject paths

envFrom, valueFrom, volumes.

Why: Wrong mount path means silent defaults. What: Match what the app reads. How: get/describe to verify objects.

Example 4: envFrom ConfigMap

Type this:

printf '%s\n' 'envFrom:' '  - configMapRef:' '      name: app-config' > /tmp/envfrom.txt && cat /tmp/envfrom.txt

You will see:

envFrom:

What it means: All keys become environment variables in the container.

Example 6: Volume mount ConfigMap file

Type this:

printf '%s\n' 'volumeMounts:' '  - name: cfg' '    mountPath: /etc/app' 'volumes:' '  - name: cfg' '    configMap:' '      name: app-config' > /tmp/volcm.txt && head -3 /tmp/volcm.txt

You will see:

volumeMounts:

What it means: Some apps read files under /etc instead of env.

Example 7: get and describe

Type this:

printf '%s\n' 'kubectl get cm app-config && kubectl describe secret app-secret'

You will see:

kubectl get cm app-config && kubectl describe secret app-secret

What it means: describe on Secret hides values — good default.

Concept 3: Rotate and restart

Pods cache env until restart.

Why: Live edit without restart confuses teams. What: rollout restart; consider immutable. How: RBAC limits readers.

Example 8: Rollout after change

Type this:

printf '%s\n' 'kubectl rollout restart deploy/web'

You will see:

kubectl rollout restart deploy/web

What it means: Pods do not always reload env until restarted.

Example 11: Immutable tip

Type this:

printf '%s\n' 'immutable: true  # optional lock so nobody patches live'

You will see:

immutable: true  # optional lock so nobody patches live

What it means: Flipkart-style safety for rare config.

Example 12: Difference one-liner

Type this:

printf '%s\n' 'ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)'

You will see:

ConfigMap = non-secret config; Secret = sensitive values (still protect etcd/RBAC)

What it means: Interviews ask this exact line.

Config/Secret card

1 ConfigMap for non-secrets 2 Secret for sensitive 3 envFrom or volume 4 rollout restart 5 never commit real passwords

Suppose: app still old config

Restart the Deployment.

Suppose: Secret in git

Rotate the value; move to a sealed/external store.

Check yourself (quiz)

ConfigMap/Secret → inject → restart. Did you understand? Let us try it once more.