LAB12: ConfigMap & Secret

LAB90: ConfigMap & Secret

---

1. CONFIGMAP — MULTIPLE SCENARIOS

A. Single Key-Value ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm-single
data:
  APP_MODE: "production"

---

B. Multiple Key-Value Pairs

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm-multi
data:
  DB_HOST: "mysql"
  DB_PORT: "3306"
  FEATURE_FLAG: "true"

---

C. YAML File Inside a ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm-yaml
data:
  config.yaml: |
    server:
      port: 8080
    logging:
      level: info

---

D. JSON File Inside a ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm-json
data:
  settings.json: |
    {
      "app": "inventory",
      "enabled": true,
      "threshold": 12
    }

---

E. Raw Text File

apiVersion: v1
kind: ConfigMap
metadata:
  name: cm-text
data:
  message.txt: |
    Hello from the ConfigMap world!
    Kubernetes delivers your words faithfully.

---

---

2. USING CONFIGMAPS IN PODS

A. Using configMapRef (envFrom)

Loads all keys as environment variables.

envFrom:
  - configMapRef:
      name: cm-multi

Inside pod:

DB_HOST=mysql
DB_PORT=3306
FEATURE_FLAG=true

---

B. Using valueFrom configMapKeyRef (only one key)

env:
  - name: DB_HOST
    valueFrom:
      configMapKeyRef:
        name: cm-multi
        key: DB_HOST

---

C. Mounting the ConfigMap as Files

volumeMounts:
  - name: config-volume
    mountPath: /etc/config
volumes:
  - name: config-volume
    configMap:
      name: cm-yaml

Inside pod:

/etc/config/config.yaml

---

D. Mounting Different Keys as Separate Files Using subPath

volumeMounts:
  - name: cm-files
    mountPath: /app/settings.json
    subPath: settings.json
  - name: cm-files
    mountPath: /app/message.txt
    subPath: message.txt

volumes:
  - name: cm-files
    configMap:
      name: cm-text

This creates:

/app/settings.json
/app/message.txt

---

Full Pod Example Combining All Uses

apiVersion: v1
kind: Pod
metadata:
  name: demo-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["/bin/sh", "-c", "sleep 3600"]

      envFrom:
        - configMapRef:
            name: cm-multi

      env:
        - name: MODE
          valueFrom:
            configMapKeyRef:
              name: cm-single
              key: APP_MODE

      volumeMounts:
        - name: yaml-cfg
          mountPath: /etc/app/config.yaml
          subPath: config.yaml

  volumes:
    - name: yaml-cfg
      configMap:
        name: cm-yaml

---

3. BASIC SECRET EXAMPLES (Parallel Same Style)

A. Secret with single key

apiVersion: v1
kind: Secret
metadata:
  name: secret-single
type: Opaque
stringData:
  PASSWORD: "myS3cur3!"

---

B. Secret with multiple keys

apiVersion: v1
kind: Secret
metadata:
  name: secret-multi
type: Opaque
stringData:
  USERNAME: admin
  TOKEN: abcdef45345

---

C. Secret file (YAML / JSON / text)

apiVersion: v1
kind: Secret
metadata:
  name: secret-file
type: Opaque
stringData:
  creds.json: |
    {
      "api_key": "KEY123",
      "role": "reader"
    }

---

Mounting Secrets in Pods

A. Secret as environment variables

envFrom:
  - secretRef:
      name: secret-multi

---

B. One key only

env:
  - name: API_TOKEN
    valueFrom:
      secretKeyRef:
        name: secret-multi
        key: TOKEN

---

C. Secret as files

volumeMounts:
  - name: secret-vol
    mountPath: /etc/creds
volumes:
  - name: secret-vol
    secret:
      secretName: secret-file

---

4. WHAT HAPPENS WHEN CONFIGMAP UPDATES?

This is where Kubernetes behaves like a stage magician 🎩 —sometimes instant, sometimes not.

A. If mounted as environment variables

❌ NOT updated automatically Environment variables are baked into the container at start.

To reflect ConfigMap changes:

• You must restart pod (or do rolling restart in Deployment).

---

B. If mounted as files (volume mount)

✔️ Automatically updated But with a tiny delay (~1–2 seconds), because kubelet syncs in background.

Inside /etc/config/... you'll see:

• New content appears

• Old symlink replaced

• Atomic file swap — no partial writes

⚠️ Except subPath: ❌ Files using subPath do NOT update. You must restart the Pod.

---

C. Deployments — How updates trigger rollout

ConfigMap change alone does NOT trigger a rollout.

You can enforce automatic rollouts using annotations:

spec:
  template:
    metadata:
      annotations:
        configmap-hash: "{{ .Values | sha256sum }}"

Or manually:

kubectl rollout restart deploy myapp

---

Quick Summary Table

Use Case	Works with Env?	Auto-Update?	Works with Volume?	Notes
configMapRef (envFrom)	Yes	❌ No	No	Restart required
configMapKeyRef	Yes	❌ No	No	Restart required
Volume Mount (normal)	No	✔️ Yes	Yes	Auto-updates
Volume Mount with subPath	No	❌ No	Yes	Restart required

---