# Kubernetes Configmaps and Secrets

In this blog, we will delve into another pivotal aspect of Kubernetes – configmaps and secrets. Kubernetes primarily manages pods and containers, and the essential data needed by users for their containers is often accessed through environment variables. To streamline this process, Kubernetes employs configmaps, allowing users to create centralized configurations within the cluster. These configmaps store crucial information such as ports, database details, and more. Consequently, users can seamlessly access and utilize this information within their Kubernetes pods by either mounting or incorporating the configmap data into their container file systems.

So, configmap is solving the problem of storing the information that can be used by the application.

Secrets in Kubernetes also deals the same as the configmaps but it deals with sensitive information. Non-sensitive information is stored in configmaps and sensitive information is stored in secrets. The sensitive data of secret before stored in etcd, gets encrypted in Rest. Kubernetes does the default encryption but it also allows us to do the custom encryption.

Strong RBAC is enforced for secrets and the least privileged access is implemented for secrets.

Let's get directly into the hands-on experience.

Let's create the configmap file as **cm.yml**

```plaintext
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-cm
data:
  db-port: "3306" 
```

Apply

```plaintext
kubectl apply -f cm.yml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706273076381/4854add6-244a-487c-b8a6-a658408adc9c.png align="center")

Our configmap is created.

We will take these data as environment variable in the kubernetes cluster.

We have the deployment.yml

```plaintext
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sample-python-app
  labels:
    app: sample-python-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: sample-python-app
  template:
    metadata:
      labels:
        app: sample-python-app
    spec:
      containers:
      - name: python-app
        image: subash07/python-app:latest
        ports:
        - containerPort: 8000
```

Create the deployment

```plaintext
kubectl apply -f deployment.yml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706279578413/1fefeeb8-363e-4412-9155-4e1856c2e0f8.png align="center")

We can see that there is no environment variable concerning db.

Let's modify the deployment.yml .

```yaml
env:
    - name: DB-PORT
      valueFrom:
        configMapKeyRef:
          name: test-cm
          key: db-port
```

We will add this in the deployment.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706280219406/eb94a83f-5c6a-4b8c-b80b-8a3113b83a22.png align="center")

Apply it

```yaml
kubectl apply -f deployment.yml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706280371321/14e5e318-0070-4d3a-b8d4-acbbf79e65fc.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706280420775/4be01fa3-6ff4-49a8-bdfa-ab525bd46258.png align="center")

So our pods are getting restarted.

Lets exec into one of the pods

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706280569475/ab635efd-f096-4ea6-8f21-e646b24a41b3.png align="center")

Perfect, it is working fine.

Instead of directly using the environment variable, we will mount it as a file.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706281121869/de0304c9-fc15-4e8e-be8c-78cfbcadc54d.png align="center")

Apply

```yaml
kubectl apply -f deployment.yml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706281274318/798106c6-57e2-4e5b-9aa9-34e8a5e80c6b.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706281402173/1b407088-02a2-4380-b4c8-da77f770e6a7.png align="center")

It's working perfectly fine. Now let's change the port from 3306 to 3307 in configmap and verify whether it gets updated or not.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706281580517/3b178c4a-3b59-44be-a8f5-5f3d73a935a8.png align="center")

configmap is updated.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706281676588/9fadc39d-27e0-4bcd-8f02-0f1d0ff7ef69.png align="center")

So the changes in the configmap are also updated in the app.

Let's create a simple secret to store the username password

```yaml
kubectl create secret generic test-secret --from-literal=db-port="3307"
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706281940323/e6933869-ecbe-414e-a5e9-5289f21ed82e.png align="center")

Our secret is created.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706282010905/352952c6-7916-40a8-b425-83e544c8b535.png align="center")

Here the db-port is encrypted.

I hope you liked this blog. If any mistake, do comment down below 🚀.

Do like and share this blog♥️