The twelve-factor app methodology principle of separating configuration from code is implemented in Kubernetes through two distinct API objects: ConfigMaps for non-sensitive configuration data and Secrets for sensitive credentials. This separation matters because the two types of data have fundamentally different security requirements: a ConfigMap containing feature flag settings or database hostnames can be read by any Pod in the namespace without concern, but a Secret containing a database password or API key must be accessible only to the specific Pods that need it, stored encrypted at rest in etcd, and auditable through Kubernetes RBAC. Understanding how both objects are injected into Pods — as environment variables, as volume-mounted files, or as command-line arguments — and the security tradeoffs of each injection method is essential because the choice determines whether credentials appear in process memory dumps, whether configuration changes require Pod restarts, and whether rotating a secret requires redeploying the application.
25 minintermediate
ConfigMaps, Secrets and environment injection — the configuration layer
Analogy🏏Cricket
🏏 Think of it like cricket: The Pod-ReplicaSet-Deployment hierarchy maps precisely onto the three levels of IPL franchise team management. A Pod is a single player on the field at a given moment — the smallest unit of participation, carrying its own identity and fulfilling a specific role in the current game. A ReplicaSet is the franchise's match-day playing XI contract — it specifies that exactly eleven players matching a specific profile must always be on the field; if one is injured and leaves, the team management immediately sends a substitute of the same profile to restore the count. A Deployment is the franchise's season-long team strategy — it manages how the playing XI evolves between matches: when a new batting approach is adopted, the Deployment replaces the old XI with the new one in a controlled rolling substitution rather than swapping all eleven players simultaneously and disrupting team cohesion. Just as the franchise director does not manage individual players directly — the playing XI contract (ReplicaSet) handles the count and the season strategy (Deployment) handles the transitions — you never manage Pods directly in production; the Deployment manages the transition and the ReplicaSet maintains the count. This reveals why the three-level hierarchy exists rather than one omnibus 'workload' object: each level solves one specific problem, and composing three focused abstractions produces better separation of concerns than one object that conflates scheduling, scaling, and update management.
Lesson 11 of 33
0% complete