yaml bash 137 lines · 2 tabs

Kubernetes ConfigMaps and Secrets management

Ryan Nakamura Feb 2026

2 tabs

# ConfigMap from literal values
apiVersion: v1
kind: ConfigMap
metadata:
  name: web-app-config
  namespace: production
data:
  APP_NAME: "MyApp"
  LOG_LEVEL: "info"
  REDIS_URL: "redis://redis:6379"
  MAX_WORKERS: "4"
  config.yaml: |
    server:
      port: 3000
      host: 0.0.0.0
    cache:
      ttl: 3600
      max_size: 1000
    features:
      dark_mode: true
      beta_features: false

---
# Secret with stringData (auto base64-encoded)
apiVersion: v1
kind: Secret
metadata:
  name: web-app-secrets
  namespace: production
type: Opaque
stringData:
  database-url: "postgres://user:password@db:5432/myapp"
  jwt-secret: "super-secret-jwt-key-here"
  api-key: "sk-1234567890abcdef"

---
# TLS Secret
apiVersion: v1
kind: Secret
metadata:
  name: app-tls-secret
  namespace: production
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-cert>
  tls.key: <base64-encoded-key>

---
# Docker registry secret
apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
  namespace: production
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: <base64-encoded-docker-config>

---
# Pod using ConfigMap and Secret
apiVersion: v1
kind: Pod
metadata:
  name: web-app-pod
spec:
  containers:
    - name: app
      image: web-app:1.0.0
      # Individual env vars
      env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: web-app-secrets
              key: database-url
        - name: LOG_LEVEL
          valueFrom:
            configMapKeyRef:
              name: web-app-config
              key: LOG_LEVEL
      # All keys as env vars
      envFrom:
        - configMapRef:
            name: web-app-config
        - secretRef:
            name: web-app-secrets
      # Mount as files
      volumeMounts:
        - name: config-files
          mountPath: /app/config
          readOnly: true
        - name: secret-files
          mountPath: /app/secrets
          readOnly: true
  volumes:
    - name: config-files
      configMap:
        name: web-app-config
        items:
          - key: config.yaml
            path: config.yaml
    - name: secret-files
      secret:
        secretName: web-app-secrets
        defaultMode: 0400

#!/bin/bash
# ConfigMap and Secret commands

# Create ConfigMap from literals
kubectl create configmap app-config   --from-literal=APP_ENV=production   --from-literal=LOG_LEVEL=info

# Create ConfigMap from file
kubectl create configmap app-config   --from-file=config.yaml   --from-file=nginx.conf

# Create ConfigMap from env file
kubectl create configmap app-config --from-env-file=.env

# Create Secret from literals
kubectl create secret generic app-secrets   --from-literal=db-password=supersecret   --from-literal=api-key=abc123

# Create TLS Secret
kubectl create secret tls app-tls   --cert=tls.crt   --key=tls.key

# Create Docker registry secret
kubectl create secret docker-registry registry-cred   --docker-server=registry.example.com   --docker-username=user   --docker-password=pass

# View ConfigMap
kubectl get configmap app-config -o yaml

# Decode Secret
kubectl get secret app-secrets -o jsonpath='{.data.db-password}' | base64 -d

# Edit in-place
kubectl edit configmap app-config

# Rollout restart after config change
kubectl rollout restart deployment/web-app

2 files · yaml, bash Explain with highlit

ConfigMaps store non-sensitive configuration as key-value pairs. Secrets store sensitive data like passwords, tokens, and certificates in base64 encoding. Both can be consumed as environment variables or mounted as files. ConfigMaps created with kubectl create configmap from literals or files. Secrets use stringData for plain-text input or data for base64-encoded values. Volume mounts project ConfigMap/Secret data as files in the container filesystem. The envFrom directive loads all keys as environment variables. Secret types include Opaque, kubernetes.io/tls, and kubernetes.io/dockerconfigjson. External tools like sealed-secrets or external-secrets encrypt Secrets for Git storage. Never commit plain Secrets to version control.

Related snips

ruby

require "timeout"

module HealthCheck
  class Probe
    Result = Struct.new(:name, :status, :latency_ms, :critical, :error, keyword_init: true) do
      def healthy?

Health Check Endpoint with Dependency Probes

rails reliability health-check

by codesnips 3 tabs

javascript

// Express app with health checks and graceful shutdown
const express = require('express');
const { createServer } = require('http');

const app = express();
const server = createServer(app);

Container health checks and graceful shutdown patterns

docker kubernetes health-checks

by Ryan Nakamura 1 tab

yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-reader
  namespace: production
---

Kubernetes RBAC roles with least privilege service accounts

kubernetes rbac least-privilege

by Kai Nakamura 1 tab

yaml

# Headless Service for stable DNS
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: production

Kubernetes StatefulSets for stateful workloads

kubernetes k8s statefulsets

by Ryan Nakamura 1 tab

typescript

import { z } from "zod";

const booleanFromString = z.preprocess((val) => {
  if (typeof val !== "string") return val;
  return ["true", "1", "yes", "on"].includes(val.toLowerCase());
}, z.boolean());

Typed env parsing with zod

typescript zod validation

by codesnips 3 tabs

typescript

import { z } from "zod";

export const envSchema = z.object({
  VITE_API_URL: z.string().url(),
  VITE_APP_NAME: z.string().min(1).default("my-app"),
  VITE_ENABLE_ANALYTICS: z

Vite env handling: explicit prefixes only

vite frontend env

by codesnips 3 tabs

Share this code

Here's the card — post it anywhere.

Kubernetes ConfigMaps and Secrets management — share card

Link copied