Pro ยท Lesson 5 of 12
ConfigMaps hold configuration. Secrets hold small sensitive values. A Secret is not encrypted just because Kubernetes accepted it.
Sign in to save your place.
A ConfigMap is a sticky note on the boat: the port, the log level, the feature flag. A Secret is a smaller note you would rather not photocopy. Base64 is a photocopy code, not a lock.
A ConfigMap can be environment variables or files mounted into the container. Mounted files can be updated without a new Pod, depending on how the kubelet syncs them. Processes that only read the environment at startup will not see a changed ConfigMap until the Pod is replaced.
Keep ConfigMaps small. They are not a place for a multi-megabyte model or a database dump. etcd has a practical object size limit.
stringData lets you write the plain value in a manifest. The API stores it as base64 in data. Anyone who can kubectl get secret -o yaml can decode it. RBAC that allows reading Secrets is a high privilege.
Encryption at rest is a kube-apiserver setting, off unless the cluster was configured with an encryption configuration. A managed cloud may offer that setting under its own name. Check the cloud page. Do not assume a new cluster has it.
Do not commit a Secret manifest with a real password. For a lab, use a fake value. For a real cluster, prefer a workflow that injects the value from a store you already trust, and still restrict who can read the Secret object.
| Claim | True? |
|---|---|
| base64 hides the value from administrators | No. It is encoding. |
| A Secret is encrypted in etcd by default | No. Encryption at rest is separate. |
| Environment variables from Secrets show up in process listings on the node | They can. A mounted file is often easier to keep out of those listings. |
Step 1 of 3Plain configuration. Safe to be boring and readable.
Step 2 of 3A Secret is an object with tighter RBAC. It is still not a vault by itself.
Step 3 of 3The Pod mounts or imports the values. The image should not have baked them in.
Use a value you invented. The decode step is the lesson: base64 is reversible.
kubectl create configmap hello-config --from-literal=LOG_LEVEL=info
kubectl create secret generic hello-secret --from-literal=TOKEN=lab-only-not-real
kubectl get secret hello-secret -o jsonpath='{.data.TOKEN}'
echo
# decode only this lab value:
kubectl get secret hello-secret -o jsonpath='{.data.TOKEN}' | base64 -d
echo
Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.