Supplying settings.
WHAT A CONFIGMAP IS
Key-value configuration, non-secret.
HOW IT REACHES A CONTAINER
As environment variables, or mounted as files.
WHAT TO PREFER FOR ANYTHING STRUCTURED
Mounted files.
WHY
Environment variables cannot hold structure, and changes require a restart.
WHAT MOUNTED CONFIGURATION PROVIDES
Updates without restarting, if the application re-reads the file.
WHAT MOST APPLICATIONS DO
Not re-read it.
WHAT THAT MEANS
A restart is needed anyway, and it should be deliberate.
HOW TO TRIGGER ONE
Change an annotation on the pod template, so the deployment rolls.
WHAT A SECRET IS
The same idea, for sensitive values.
WHAT TO KNOW ABOUT SECRETS
They are encoded, not encrypted, by default.
WHAT THAT MEANS
Anyone able to read them in the cluster can read the values.
WHAT TO ENABLE
Encryption at rest for secret storage.
WHAT TO RESTRICT
Who may read secrets, through access control.
WHAT TO AVOID
Committing secret manifests to version control.
WHAT TO USE INSTEAD
An external secrets manager, or encrypted manifests with a key held separately.
WHAT TO ROTATE
Everything, on a schedule.
WHAT TO AUDIT
Who has read access to secrets.
