ConfigMaps and Secrets — Kubernetes (K8s) & AKS

5. ConfigMaps and Secrets

Basic★ Must knowLesson 5 of 15

yaml

apiVersion: v1
kind: ConfigMap
metadata: { name: shop-config }
data:
  Logging__LogLevel__Default: "Information"
  FeatureFlags__NewCheckout: "true"
---
apiVersion: v1
kind: Secret
metadata: { name: shop-secrets }
type: Opaque
stringData:
  ConnectionStrings__Db: "Server=tcp:sql.example.net;Database=Shop;Authentication=Active Directory Workload Identity"

yaml

# in the container spec
envFrom:
  - configMapRef: { name: shop-config }
  - secretRef: { name: shop-secrets }
volumeMounts:
  - { name: cfg, mountPath: /app/config, readOnly: true }
# volumes: - name: cfg  configMap: { name: shop-config }

Secrets are only base64-encoded, not encrypted, by default — enable etcd encryption at rest, restrict access with RBAC, and prefer external secret stores: Azure Key Vault via the Secrets Store CSI Driver, External Secrets Operator, plus Workload Identity so pods authenticate to Azure without stored credentials. Env vars from ConfigMaps don't update in running pods (restart needed); mounted files do update.