ConfigMap vs Secret
Compare non-sensitive configuration management with sensitive data storage in Kubernetes.
Containers
ConfigMap
A ConfigMap stores non-sensitive configuration data for Kubernetes workloads. It is commonly used for environment values, application settings, and general runtime configuration.
Containers
Secret
A Secret stores sensitive data such as passwords, API keys, tokens, and certificates. It is designed for values that require more secure handling than normal application configuration.
Key Differences
ConfigMaps are intended for non-sensitive application configuration, while Secrets are intended for sensitive values.
Both can be consumed by pods as environment variables or mounted files, but they should not be treated the same from a security perspective.
Secrets are often protected through stricter access controls and may be encrypted at rest, while ConfigMaps are general configuration objects.
Putting secrets into ConfigMaps is a common security mistake.
ConfigMaps are easier to use for regular config, while Secrets require stronger operational handling and access discipline.
The main difference is not how pods consume them, but what kind of data they are meant to hold and how securely they should be treated.
When to Use
When to use ConfigMap
Use ConfigMap for application settings, feature flags, ports, and non-sensitive environment values that do not require credential protection.
When to use Secret
Use Secret for passwords, API keys, tokens, certificates, and any data that should be protected from casual exposure or misuse.
Tradeoffs
ConfigMaps are simple and convenient, but inappropriate for sensitive data.
Secrets are the correct mechanism for sensitive values, but they still need strong RBAC, encryption, and secure operational handling.
Using the right object type improves both clarity and security posture.
Common Mistakes
Storing passwords or API keys inside ConfigMaps.
Assuming that a Kubernetes Secret is fully secure without proper RBAC or encryption settings.
Treating ConfigMaps and Secrets as interchangeable because pods can consume both similarly.
Interview Tip
Good interview answer: ConfigMap is for normal configuration. Secret is for sensitive values, but it still needs strong security controls.