ConfigMaps: Decoupling Application Configuration from Container Images
A ConfigMap stores non-sensitive configuration data as key-value pairs that can be injected into pods as environment variables, command arguments, or mounted...
Quick Answer: A ConfigMap stores non-sensitive configuration data as key-value pairs that can be injected into pods as environment variables, command arguments, or mounted files — decoupling config from container images.
Detailed Answer:
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
namespace: production
data:
# Simple key-value pairs → used as env vars
APP_ENV: "production"
LOG_LEVEL: "warn"
MAX_CONNECTIONS: "100"
# File content → mounted as files in pod
config.yaml: |
server:
port: 8080
timeout: 30s
database:
pool_size: 10
max_idle: 5
nginx.conf: |
server {
listen 80;
location / {
proxy_pass http://localhost:8080;
}
}
# Three ways to consume a ConfigMap in a Pod:
# 1. Individual env vars
env:
- name: APP_ENV
valueFrom:
configMapKeyRef:
name: app-config
key: APP_ENV
# 2. All keys as env vars at once
envFrom:
- configMapRef:
name: app-config
# 3. Mount as files (for config files)
volumes:
- name: config-vol
configMap:
name: app-config
items:
- key: config.yaml
path: config.yaml # Mounted at /etc/config/config.yaml
- key: nginx.conf
path: nginx.conf # Mounted at /etc/config/nginx.conf
volumeMounts:
- name: config-vol
mountPath: /etc/config
readOnly: true
Important Behavior — Hot Reloading:
When a ConfigMap is mounted as a volume, Kubernetes automatically updates the file in the pod when the ConfigMap changes (within ~60 seconds via kubelet sync). When injected as environment variables, the pod must be restarted to pick up changes.
# Update a ConfigMap
kubectl edit configmap app-config
# or
kubectl create configmap app-config --from-file=config.yaml \
--dry-run=client -o yaml | kubectl apply -f -
# Force pod restart to pick up env var changes
kubectl rollout restart deployment/my-app
Common Mistake:
Storing sensitive data (passwords, API keys, tokens) in ConfigMaps. ConfigMaps are stored in plain text in etcd and visible to anyone with read access to the namespace. Use Secrets for sensitive data.
Key Takeaway: ConfigMaps decouple configuration from images — the same image runs in dev, staging, and production with different ConfigMaps, never requiring a rebuild for config changes.
Finished reading?
Mark as complete to claim your +10 XP and track progress.