DEV Community

Cover image for 🔐 Kubernetes Secrets & ConfigMaps: Securely Manage Your App Configurations
zaheetdev
zaheetdev

Posted on

🔐 Kubernetes Secrets & ConfigMaps: Securely Manage Your App Configurations

#kubernetes #devops #yaml #security

Managing your app configurations and secrets securely is non-negotiable in modern cloud-native development. Kubernetes offers two native resources to do this:

  • 🛠 ConfigMaps for non-sensitive configuration
  • 🔐 Secrets for credentials, tokens, and other sensitive values

In this guide, we’ll show how to use both in a real-world Node.js app deployed to Kubernetes.

✨ What You'll Learn

✅ Difference between ConfigMaps and Secrets

✅ Creating secure configurations using YAML

✅ Deploying a Node.js app with injected env vars

✅ Debugging and accessing environment inside the container

✅ Docker + Kubernetes best practices for configuration

📦 Demo Image & Source Code

We're using a public Docker image that reads environment variables and returns them:

📁 Project Structure 

k8s-config-demo/
├── index.js
├── Dockerfile
├── configmap.yaml
├── secret.yaml
└── deployment.yaml
Enter fullscreen mode Exit fullscreen mode

🧠 Why ConfigMaps & Secrets?

ConfigMap

  • Stores non-sensitive values like APP_MODE, URLs, etc.

Secret

  • Stores sensitive data like DB_USER, DB_PASSWORD
  • Encoded in Base64 and supports encryption at rest

Using them ensures:

  • 🔐 You don’t hardcode values
  • 🔁 You can change config without rebuilding the image
  • 🧩 They integrate cleanly into deployments

🧰 The Application Code (index.js) 

const http = require('http');
const PORT = process.env.PORT || 3000;
const DB_USER = process.env.DB_USER;
const DB_PASSWORD = process.env.DB_PASSWORD;
const APP_MODE = process.env.APP_MODE || 'dev';

http.createServer((req, res) => {
  res.end(`Mode: ${APP_MODE}, DB_USER: ${DB_USER}`);
}).listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});
Enter fullscreen mode Exit fullscreen mode

🐳 Dockerfile 

FROM node:alpine
WORKDIR /app
COPY index.js .
CMD ["node", "index.js"]
Enter fullscreen mode Exit fullscreen mode

Build and push (already done):

docker build -t zaheetdeveloper/k8s-config-demo:v1 .
docker push zaheetdeveloper/k8s-config-demo:v1
Enter fullscreen mode Exit fullscreen mode

🔧 Step-by-Step Kubernetes Setup

1️⃣ Create the ConfigMap 

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_MODE: production
Enter fullscreen mode Exit fullscreen mode 
kubectl apply -f configmap.yaml
Enter fullscreen mode Exit fullscreen mode

Config creation successful

2️⃣ Create the Secret 

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  DB_USER: YWRtaW4=       # 'admin'
  DB_PASSWORD: c2VjdXJl   # 'secure'
Enter fullscreen mode Exit fullscreen mode 
kubectl apply -f secret.yaml
Enter fullscreen mode Exit fullscreen mode

Creating Secrets with kubectl

3️⃣ Create the Deployment 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-config-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: config-app
  template:
    metadata:
      labels:
        app: config-app
    spec:
      automountServiceAccountToken: false
      containers:
      - name: app-container
        image: zaheetdeveloper/k8s-config-demo:v1
        env:
        - name: APP_MODE
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: APP_MODE
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_USER
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_PASSWORD
        ports:
        - containerPort: 3000
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
            ephemeral-storage: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
            ephemeral-storage: "512Mi"
Enter fullscreen mode Exit fullscreen mode 
kubectl apply -f deployment.yaml
Enter fullscreen mode Exit fullscreen mode

App Deployment and Get Pods Screenshot

🧪 Testing & Debugging 

kubectl get pods
kubectl logs -l app=config-app
Enter fullscreen mode Exit fullscreen mode

Expected output:

Server running on port 3000
Enter fullscreen mode Exit fullscreen mode

App Logs Screenshot

kubectl port-forward deployment/app-config-test 3000:3000
Enter fullscreen mode Exit fullscreen mode

Visit in browser: http://localhost:3000
App NodeJs Browser Screenshot

kubectl exec -it pod/<pod-name> -- /bin/sh
env
Enter fullscreen mode Exit fullscreen mode

App Bash and its env Screenshot

🛡️ Best Practices

  • Encrypt secrets at rest using KMS
  • Avoid storing secrets in source code
  • Use RBAC to control access
  • Explore tools like Sealed Secrets or External Secrets Operator

💬 Conclusion

You now know how to:

  • Use ConfigMaps and Secrets in Kubernetes
  • Inject them securely into containers
  • Deploy and inspect a working environment

➡️ Demo image: Docker Hub

📂 Source code & YAMLs: GitHub

Top comments (0)