Kubernetes ConfigMaps and Secrets

kubectl create configmap app-config \
  --from-literal=NODE_ENV=production \
  --from-literal=PORT=3000 \
  --from-literal=LOG_LEVEL=info

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  NODE_ENV: "production"
  PORT: "3000"
  LOG_LEVEL: "info"
  config.json: |
    {
      "features": {
        "darkMode": true,
        "betaFeatures": false
      },
      "cache": {
        "ttl": 3600
      }
    }

kubectl create configmap nginx-config --from-file=nginx.conf
kubectl create configmap app-config --from-env-file=.env.production

spec:
  containers:
    - name: app
      image: my-app
      # All keys as env vars
      envFrom:
        - configMapRef:
            name: app-config
      # Or specific keys
      env:
        - name: APP_PORT
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: PORT

spec:
  containers:
    - name: app
      volumeMounts:
        - name: config
          mountPath: /app/config
          readOnly: true
  volumes:
    - name: config
      configMap:
        name: app-config
        items:
          - key: config.json
            path: config.json

# From literals
kubectl create secret generic db-credentials \
  --from-literal=username=appuser \
  --from-literal=password='S3cur3P@ss!'

# From file (e.g., TLS certificate)
kubectl create secret tls app-tls \
  --cert=tls.crt \
  --key=tls.key

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YXBwdXNlcg==          # echo -n "appuser" | base64
  password: UzNjdXIzUEBzcyE=     # echo -n "S3cur3P@ss!" | base64

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
stringData:
  username: appuser
  password: "S3cur3P@ss!"
  DATABASE_URL: "postgresql://appuser:S3cur3P@ss!@db:5432/myapp"

spec:
  containers:
    - name: app
      envFrom:
        - secretRef:
            name: db-credentials
      # Or specific keys
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: password
      # Or as files
      volumeMounts:
        - name: secrets
          mountPath: /app/secrets
          readOnly: true
  volumes:
    - name: secrets
      secret:
        secretName: db-credentials

# Install kubeseal
brew install kubeseal

# Seal a secret (encrypted with cluster's public key)
kubectl create secret generic db-creds \
  --from-literal=password=S3cur3 \
  --dry-run=client -o yaml | \
  kubeseal --format yaml > sealed-secret.yaml

# sealed-secret.yaml (safe to commit to Git)
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-creds
spec:
  encryptedData:
    password: AgBj7s8...encrypted...

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets
    kind: ClusterSecretStore
  target:
    name: app-secrets
  data:
    - secretKey: DATABASE_URL
      remoteRef:
        key: production/app/database
    - secretKey: API_KEY
      remoteRef:
        key: production/app/api-key