Configuring ConfigMaps and Secrets

Introduction

This tutorial will guide you through the process of configuring ConfigMaps and Secrets in Kubernetes. ConfigMaps allow you to decouple configuration artifacts from image content to keep applications portable. Secrets are designed to store sensitive information, such as passwords, OAuth tokens, and SSH keys. Understanding how to create and manage these resources is critical for the Certified Kubernetes Administrator (CKA) exam. This tutorial assumes you have a running Kubernetes cluster and kubectl configured.

Task 1: Creating a ConfigMap

ConfigMaps can be created from literal values, files, or generated. Let’s start by creating a ConfigMap from literal values.

1. Create a ConfigMap named game-config with two key-value pairs: player_initial_lives=3 and ui_properties_file_name=user-interface.properties.

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl create configmap game-config --from-literal=player_initial_lives=3 --from-literal=ui_properties_file_name=user-interface.properties

   Use descriptive names for your ConfigMaps to make them easily identifiable.

2. Verify the ConfigMap was created successfully.

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl get configmap game-config -o yaml

3. Expected output:

   NODE_TYPE // output

   [ COPY_HEX ]

   apiVersion: v1
   data:
     player_initial_lives: "3"
     ui_properties_file_name: user-interface.properties
   kind: ConfigMap
   metadata:
     creationTimestamp: "2024-07-26T10:00:00Z"
     name: game-config
     namespace: default
     resourceVersion: "123"
     uid: a1b2c3d4-e5f6-7890-1234-567890abcdef

Task 2: Using a ConfigMap in a Pod

Now, let’s consume the ConfigMap in a Pod. We’ll inject the ConfigMap values as environment variables.

1. Create a pod definition file named pod-with-configmap.yaml:

   NODE_TYPE // yaml

   [ COPY_HEX ]

   apiVersion: v1
   kind: Pod
   metadata:
     name: game-pod
   spec:
     containers:
       - name: game-container
         image: busybox:latest
         command: ['sh', '-c', 'echo Player lives: $(PLAYER_INITIAL_LIVES) && echo UI file: $(UI_PROPERTIES_FILE_NAME) && sleep 3600']
         envFrom:
           - configMapRef:
               name: game-config
     restartPolicy: Never

   Always define a restartPolicy for your Pods. Never is suitable for one-off tasks, while Always or OnFailure are more appropriate for long-running applications.

2. Create the Pod:

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl apply -f pod-with-configmap.yaml

3. Check the Pod’s logs:

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl logs game-pod

4. Expected output:

   NODE_TYPE // output

   [ COPY_HEX ]

   Player lives: 3
   UI file: user-interface.properties

Task 3: Creating a Secret

Secrets are used to store sensitive information. Let’s create a Secret to store a database password.

1. Create a Secret named db-secret with a key named db_password.

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl create secret generic db-secret --from-literal=db_password=SuperSecretPassword

   Kubernetes Secrets are base64 encoded, not encrypted by default. Consider using encryption at rest for enhanced security.

2. Verify the Secret was created successfully.

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl get secret db-secret -o yaml

3. Expected output (the actual value will be base64 encoded):

   NODE_TYPE // output

   [ COPY_HEX ]

   apiVersion: v1
   data:
     db_password: U3VwZXJTZWNyZXRQYXNzd29yZA==
   kind: Secret
   metadata:
     creationTimestamp: "2024-07-26T10:10:00Z"
     name: db-secret
     namespace: default
     resourceVersion: "456"
     uid: b2c3d4e5-f6a7-8901-2345-678901abcdef
   type: Opaque

Task 4: Using a Secret in a Pod

Now, let’s consume the Secret in a Pod. We’ll inject the secret value as an environment variable.

1. Create a pod definition file named pod-with-secret.yaml:

   NODE_TYPE // yaml

   [ COPY_HEX ]

   apiVersion: v1
   kind: Pod
   metadata:
     name: db-pod
   spec:
     containers:
       - name: db-container
         image: busybox:latest
         command: ['sh', '-c', 'echo DB Password: $(DB_PASSWORD) && sleep 3600']
         env:
           - name: DB_PASSWORD
             valueFrom:
               secretKeyRef:
                 name: db-secret
                 key: db_password
     restartPolicy: Never

2. Create the Pod:

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl apply -f pod-with-secret.yaml

3. Check the Pod’s logs:

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl logs db-pod

4. Expected output:

   NODE_TYPE // output

   [ COPY_HEX ]

   DB Password: SuperSecretPassword

Task 5: Updating a ConfigMap

ConfigMaps can be updated, and Pods can be configured to automatically receive these updates. Let’s update our game-config ConfigMap.

1. Update the player_initial_lives value to 5.

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl create configmap game-config --from-literal=player_initial_lives=5 --from-literal=ui_properties_file_name=user-interface.properties -o yaml --dry-run=client | kubectl apply -f -

   kubectl apply is generally the best practice for production environments, because it does server-side diffing, however kubectl edit configmap game-config is another valid alternative.

2. Verify the ConfigMap was updated.

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl get configmap game-config -o yaml

3. Expected output:

   NODE_TYPE // output

   [ COPY_HEX ]

   apiVersion: v1
   data:
     player_initial_lives: "5"
     ui_properties_file_name: user-interface.properties
   kind: ConfigMap
   metadata:
     creationTimestamp: "2024-07-26T10:00:00Z"
     name: game-config
     namespace: default
     resourceVersion: "789"
     uid: a1b2c3d4-e5f6-7890-1234-567890abcdef

4. Delete and recreate the game-pod pod to observe the changes (in a real-world scenario, you’d likely use a Deployment with rolling updates).

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl delete pod game-pod
   kubectl apply -f pod-with-configmap.yaml

5. Check the Pod’s logs again:

   NODE_TYPE // bash

   [ COPY_HEX ]

   kubectl logs game-pod

6. Expected output:

   NODE_TYPE // output

   [ COPY_HEX ]

   Player lives: 5
   UI file: user-interface.properties

Conclusion

In this tutorial, you learned how to create and use ConfigMaps and Secrets in Kubernetes. You created ConfigMaps from literal values, injected them into Pods as environment variables, created Secrets to store sensitive data, and updated a ConfigMap. This knowledge is crucial for managing application configuration and sensitive information securely in Kubernetes and is essential for the CKA exam.