Keep configuration out of the image

Study notes

• The twelve-factor principle is to keep configuration out of the build artifact so one image can be promoted from staging to production unchanged. Kubernetes gives you two objects for this. A ConfigMap stores non-sensitive settings, either as individual keys or as whole files. A Secret has the same shape but is intended for credentials, tokens and certificates, and has its own RBAC and optional encryption at rest.
• The most important fact is that a Secret is base64 encoded, not encrypted, by default. Base64 is a transport encoding anyone can reverse. Real protection comes from three things: tight RBAC so few identities can read Secrets, encryption at rest for etcd (managed clusters usually offer this with a cloud KMS key), and, best of all, not storing the source of truth in the cluster at all by syncing from an external secret manager.
• You consume both in two ways. Environment variables are simple but are fixed when the container starts, so changing the ConfigMap requires a rollout. Mounted files are refreshed by the kubelet after a delay, which suits applications that reload config; note that subPath mounts do not update.
• Gotcha: committing Secret manifests to Git exposes them to anyone with repository access. Use sealed or external secrets, which Deck 5 covers.

Deck map