Storing configuration and secrets

Configmaps are very generic configuration files. They can consist of a list of key value pairs but they can also be generic files. For example you can store a nginx configuration file nginx.conf in a configmap and load it in the proper location for the nginx daemon to read it.

Secrets are supposed to be used for storing sensitive data, unfortunately right now secrets are not encrypted, they are just based64 encoded. So while this helps you remove hardcoded non-encrypted values from your manifests, it does not help with encryption at all. This should get better in v1.7

You can set environment variables in your deployment manifest to point to specific values in secrets or configmaps. Both are also easily generated with kubectl for example:

• kubectl create secret generic foobar --from-literal=password=foobar
• kubectl create configmap foobar --from-file=foobar.conf

Helm charts best practice is to use both, see mariadb chart.

Personally, when I need to load a file in a Pod I use a configmap, and when I deal with a sensitive env variable I use a secret, keeping in mind that it is not encrypted.