configmap-secret

ConfigMap and Secret

Overview

Skills such as configuration management and sensitive information handling.

ConfigMap

Create ConfigMap

# 从字面值创建
kubectl create configmap my-config --from-literal=key1=value1 --from-literal=key2=value2

# 从文件创建
kubectl create configmap my-config --from-file=config.properties
kubectl create configmap my-config --from-file=my-key=config.properties

# 从目录创建
kubectl create configmap my-config --from-file=config-dir/

Create from environment file

kubectl create configmap my-config --from-env-file=env.properties

### ConfigMap YAML
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
data:
  # 简单键值对
  database_url: "mysql://localhost:3306/mydb"
  log_level: "info"
  
  # 多行配置文件
  nginx.conf: |
    server {
        listen 80;
        server_name localhost;
        location / {
            root /usr/share/nginx/html;
        }
    }
  
  # JSON 配置
  config.json: |
    {
      "debug": true,
      "port": 8080
    }

Use ConfigMap

Environment variable method

spec:
  containers:
  - name: app
    env:
    # 单个键
    - name: DATABASE_URL
      valueFrom:
        configMapKeyRef:
          name: my-config
          key: database_url
    # 所有键
    envFrom:
    - configMapRef:
        name: my-config

Mount as file

spec:
  containers:
  - name: app
    volumeMounts:
    - name: config-volume
      mountPath: /etc/config
  volumes:
  - name: config-volume
    configMap:
      name: my-config
      # 可选：指定特定键
      items:
      - key: nginx.conf
        path: nginx.conf

Mount as a single file (without overwriting the directory)

spec:
  containers:
  - name: app
    volumeMounts:
    - name: config-volume
      mountPath: /etc/app/config.json
      subPath: config.json
  volumes:
  - name: config-volume
    configMap:
      name: my-config

Secret

Create Secret

# 从字面值创建
kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=secret123

# 从文件创建
kubectl create secret generic my-secret --from-file=ssh-privatekey=~/.ssh/id_rsa

# TLS Secret
kubectl create secret tls tls-secret --cert=cert.pem --key=key.pem

# Docker Registry Secret
kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=password \
  --docker-email=user@example.com

Secret YAML

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  # Base64 编码
  username: YWRtaW4=
  password: c2VjcmV0MTIz
---
# 使用 stringData（自动编码）
apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
stringData:
  username: admin
  password: secret123

Secret types

# Opaque（默认）
type: Opaque

# TLS
type: kubernetes.io/tls
data:
  tls.crt: <base64>
  tls.key: <base64>

# Docker Registry
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: <base64>

# Basic Auth
type: kubernetes.io/basic-auth
data:
  username: <base64>
  password: <base64>

# SSH Auth
type: kubernetes.io/ssh-auth
data:
  ssh-privatekey: <base64>

Use Secret

Environment variable method

spec:
  containers:
  - name: app
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: my-secret
          key: password
    envFrom:
    - secretRef:
        name: my-secret

Mount as file

spec:
  containers:
  - name: app
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: my-secret
      defaultMode: 0400

Image pull credentials

spec:
  imagePullSecrets:
  - name: regcred
  containers:
  - name: app
    image: registry.example.com/myapp:latest

Operation commands

# 查看 ConfigMap
kubectl get configmap
kubectl describe configmap my-config
kubectl get configmap my-config -o yaml

# 查看 Secret
kubectl get secret
kubectl describe secret my-secret
kubectl get secret my-secret -o yaml

# 解码 Secret
kubectl get secret my-secret -o jsonpath='{.data.password}' | base64 -d

# 编辑
kubectl edit configmap my-config
kubectl edit secret my-secret

# 删除
kubectl delete configmap my-config
kubectl delete secret my-secret

Common scenarios

Scenario 1: Application configuration hot update

# 使用 ConfigMap 挂载（自动更新）
spec:
  containers:
  - name: app
    volumeMounts:
    - name: config
      mountPath: /etc/config
  volumes:
  - name: config
    configMap:
      name: my-config
# 注意：subPath 挂载不会自动更新

Scenario 2: Multi-environment configuration

# 创建不同环境的 ConfigMap
kubectl create configmap app-config-dev --from-file=config-dev/
kubectl create configmap app-config-prod --from-file=config-prod/

# 在 Deployment 中引用
# 通过 Kustomize 或 Helm 管理不同环境

Scenario 3: External Secret management

# 使用 External Secrets Operator
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: SecretStore
  target:
    name: my-secret
  data:
  - secretKey: password
    remoteRef:
      key: prod/db/password

Scenario 4: Configuration file template

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  application.yaml: |
    server:
      port: ${SERVER_PORT:8080}
    database:
      url: ${DATABASE_URL}
      username: ${DATABASE_USER}

Best practices

# 1. 不要在 Git 中存储 Secret
# 使用 Sealed Secrets 或 External Secrets

# 2. 限制 Secret 访问权限
# 使用 RBAC 控制

# 3. 定期轮换 Secret
# 使用自动化工具

# 4. 使用 immutable ConfigMap/Secret（K8s 1.21+）

apiVersion: v1
kind: ConfigMap
metadata:
  name: immutable-config
immutable: true
data:
  key: value

Troubleshooting

Issue	Troubleshooting method
Configuration not updated	Check whether subPath is used, restart the Pod
Secret decoding error	Check whether the Base64 encoding is correct
Permission issue	Check defaultMode, RBAC
Mounting failed	Check whether the ConfigMap/Secret exists

# 检查挂载
kubectl exec pod-name -- ls -la /etc/config
kubectl exec pod-name -- cat /etc/config/key

# 检查环境变量
kubectl exec pod-name -- env | grep KEY