Skip to main content

Chapter 5.4 - Best Practices

Learning Objectives​

By the end of this chapter, you will be able to:

  • Apply best practices for ConfigMaps
  • Manage secrets securely
  • Understand limits and constraints
  • Implement secret rotation
  • Use External Secrets Operator
  • Set up encryption at rest

Introduction​

Best practices for ConfigMaps and Secrets are essential to maintain a secure, maintainable, and performant Kubernetes environment.

ConfigMaps: Best Practices​

1. Configuration Separation​

Do not hardcode in code:

# Bad
env:
- name: DATABASE_URL
  value: "postgresql://localhost:5432/mydb"

# Good
env:
- name: DATABASE_URL
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: database_url

2. Organization by Environment​

Create separate ConfigMaps for each environment:

# Dev
kubectl create configmap app-config-dev --from-file=config-dev.properties

# Production
kubectl create configmap app-config-prod --from-file=config-prod.properties

3. Versioning​

Use labels for versioning:

metadata:
  name: app-config
  labels:
    version: v1
    environment: production

Secrets: Best Practices​

1. Never Commit​

Never do:

  • Commit secrets to Git
  • Put secrets in plain text in YAML files
  • Share secrets via email/chat

Do:

  • Use secret management tools
  • Encrypt secrets at rest
  • Use External Secrets Operator

2. Regular Rotation​

# Create a new secret
kubectl create secret generic db-secret-v2 \
  --from-literal=password=new-password

# Update the Deployment
kubectl set env deployment/my-app \
  DB_PASSWORD=$(kubectl get secret db-secret-v2 -o jsonpath='{.data.password}' | base64 -d)

# Delete the old secret
kubectl delete secret db-secret-v1

3. Encryption at Rest​

Kubernetes stores secrets in base64 (no encryption by default).

Solutions:

  • Enable encryption at rest (EncryptionConfig)
  • Use external tools (Vault, AWS Secrets Manager)

Limits and Constraints​

Maximum Size​

  • ConfigMap: 1 MiB per entry
  • Secret: 1 MiB per entry
  • Total: Limited by etcd (typically 1.5 MiB)

Performance​

  • Large ConfigMaps can slow down Pod startup
  • Prefer multiple small ConfigMaps

External Secrets Operator​

For external secrets (AWS, Azure, GCP, Vault):

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-secret
spec:
  secretStoreRef:
    name: aws-secrets-manager
    kind: SecretStore
  target:
    name: db-secret
    creationPolicy: Owner
  data:
  - secretKey: password
    remoteRef:
      key: production/database/password

Summary​

In this chapter, you learned:

ConfigMaps: Separate config from code, organize by environment
Secrets: Never commit, regular rotation, encryption
Limits: Maximum size, performance considerations
Tools: External Secrets Operator for external secrets
Security: Encryption at rest, centralized management

Next Steps​

Lab 5.1: Creating and Using ConfigMaps
Lab 5.2: Managing Secrets

Chapter created: December 2024