ConfigMaps vs Secrets: How database settings reach a Pod

Use a ConfigMap for ordinary settings and a Secret for sensitive values. Here, DB_URL and DB_USER are treated as non-sensitive, while DB_PASSWORD is sensitive; both resources provide their values to the same application Pod.

This manifest creates a ConfigMap named db-config with two text settings: the database URL and username. In this example, neither is sensitive, so they belong here rather than in a Secret.

Here, db-credentials is a Secret for the sensitive DB_PASSWORD. stringData lets you write the value in readable form; Kubernetes converts it for storage, but that alone doesn’t protect it from exposure.

The app container references both resources with envFrom. db-config supplies DB_URL and DB_USER, while db-credentials supplies DB_PASSWORD. Their keys become environment-variable names; the values stay in the ConfigMap and Secret, rather than being written into the Pod specification.

At startup, the kubelet fetches the referenced ConfigMap and Secret, then sets the Pod’s environment for its container. The application reads DB_URL and DB_USER from the ConfigMap and DB_PASSWORD from the Secret. The values become environment variables; they aren’t written directly into the Pod specification.

Let's think this through. Which resource should supply the application's database password? A: The ConfigMap holding the database URL. B: The Secret holding the password. C: The Pod name. Choose an answer, or just think it through. I'll explain in a moment.

The answer is B: The Secret holding the password. The password is sensitive, so the Pod should reference a Secret for that value. The ConfigMap holds the URL and username because this example assumes they are not sensitive. A Secret still needs access controls.

A Secret’s base64 representation isn’t encryption, so it isn’t leak-proof. Restrict access with RBAC, consider encryption at rest, and keep DB_PASSWORD out of application logs.

Use ConfigMaps for non-sensitive configuration and Secrets for sensitive values. DB_URL and DB_USER come from the ConfigMap; DB_PASSWORD comes from the Secret. Pod references deliver all three as environment variables.