Kubernetes Cheatsheet

ConfigMaps and Secrets

Use this Kubernetes reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

ConfigMap

Stores non-sensitive key-value config. Values are plain strings.

Create

# from literal values
kubectl create configmap app-config \
  --from-literal=APP_ENV=production \
  --from-literal=LOG_LEVEL=info

# from a .env file
kubectl create configmap app-config --from-env-file=.env

# from a directory (each file becomes a key)
kubectl create configmap nginx-conf --from-file=./conf.d/

# from a single file with a custom key
kubectl create configmap nginx-conf --from-file=nginx.conf=/etc/nginx/nginx.conf

Manifest

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: production
  LOG_LEVEL: info
  config.yaml: |
    server:
      port: 8080
      timeout: 30s

Secret

Like ConfigMap but base64-encoded and handled with more care by the API server.

Secret Types

Type	Use
`Opaque`	Generic key-value (default)
`kubernetes.io/tls`	TLS cert + key (`tls.crt`, `tls.key`)
`kubernetes.io/dockerconfigjson`	Image pull credentials
`kubernetes.io/service-account-token`	SA tokens (auto-created)
`kubernetes.io/basic-auth`	`username` + `password`

Create

# generic/opaque
kubectl create secret generic db-secret \
  --from-literal=password=s3cr3t \
  --from-literal=username=admin

# from file (good for TLS certs)
kubectl create secret tls my-tls \
  --cert=server.crt \
  --key=server.key

# docker registry credentials
kubectl create secret docker-registry regcreds \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=pass \
  --docker-email=user@example.com

Manifest (values are base64)

echo -n "s3cr3t" | base64    # czNjcjN0

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  password: czNjcjN0      # base64("s3cr3t")
stringData:               # plain text — k8s encodes at apply time
  username: admin

Injecting into Pods

As environment variables

containers:
- name: app
  image: myapp:v1
  env:
  - name: LOG_LEVEL
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: LOG_LEVEL
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password

Load all keys from a ConfigMap/Secret

  envFrom:
  - configMapRef:
      name: app-config
  - secretRef:
      name: db-secret

As mounted files (volume)

spec:
  volumes:
  - name: config-vol
    configMap:
      name: app-config
  - name: secret-vol
    secret:
      secretName: db-secret
      defaultMode: 0400     # permissions on the files
  containers:
  - name: app
    volumeMounts:
    - name: config-vol
      mountPath: /etc/config
      readOnly: true
    - name: secret-vol
      mountPath: /etc/secrets
      readOnly: true

Each key becomes a file: /etc/config/LOG_LEVEL, /etc/secrets/password, etc.

Mount a single key

  volumes:
  - name: nginx-conf
    configMap:
      name: nginx-config
      items:
      - key: nginx.conf
        path: nginx.conf    # filename inside mountPath

kubectl Commands

Command	What it does
`kubectl get configmaps`	List ConfigMaps
`kubectl describe configmap app-config`	Show keys and values
`kubectl get secret db-secret -o yaml`	Show Secret (base64)
`kubectl get secret db-secret -o jsonpath='{.data.password}' \| base64 -d`	Decode a key
`kubectl edit configmap app-config`	Edit in-place
`kubectl delete configmap app-config`	Delete

Immutable ConfigMaps and Secrets

Prevent accidental updates and improve performance (kubelet stops watching):

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config-v2
immutable: true
data:
  APP_ENV: production

External Secrets (common pattern)

Use External Secrets Operator to sync from AWS Secrets Manager, Vault, GCP SM, etc.:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: db-secret
  data:
  - secretKey: password
    remoteRef:
      key: prod/db
      property: password