Skip to main content

Lab 5.3 - Injecting Configuration into Pods

Objectives​

By the end of this lab, you will be able to:

  • Inject ConfigMaps as environment variables
  • Mount ConfigMaps as volumes
  • Use Secrets securely
  • Understand the differences between env and volumes

Prerequisites​

  • Functional Kubernetes cluster
  • kubectl configured
  • Understanding of ConfigMaps and Secrets

Exercise 1: Environment Variables from ConfigMap​

Step 1: Create the ConfigMap​

kubectl create configmap app-config \
  --from-literal=database_url=postgresql://localhost:5432/mydb \
  --from-literal=log_level=info \
  --from-literal=max_connections=100

Step 2: Create a Pod with env​

Create a file pod-env.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-env
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "env | grep -E 'DATABASE|LOG|MAX' && sleep 3600"]
    env:
    - name: DATABASE_URL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: database_url
    - name: LOG_LEVEL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: log_level
    - name: MAX_CONNECTIONS
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: max_connections

Step 3: Deploy and Verify​

kubectl apply -f pod-env.yaml
kubectl logs app-pod-env

Exercise 2: envFrom for All Keys​

Create a Pod with envFrom​

Create pod-envfrom.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-envfrom
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "env | grep -E 'database|log|max' && sleep 3600"]
    envFrom:
    - configMapRef:
        name: app-config

Deploy and Verify​

kubectl apply -f pod-envfrom.yaml
kubectl logs app-pod-envfrom

Exercise 3: ConfigMap as a Volume​

Create a ConfigMap with a File​

cat > nginx.conf <<EOF
server {
    listen 80;
    server_name example.com;
    root /usr/share/nginx/html;
}
EOF

kubectl create configmap nginx-config --from-file=nginx.conf

Create a Pod with a Volume​

Create pod-volume.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
spec:
  containers:
  - name: nginx
    image: nginx:1.20
    volumeMounts:
    - name: config
      mountPath: /etc/nginx/conf.d
      readOnly: true
  volumes:
  - name: config
    configMap:
      name: nginx-config

Deploy and Verify​

kubectl apply -f pod-volume.yaml
kubectl exec nginx-pod -- cat /etc/nginx/conf.d/nginx.conf

Exercise 4: Secrets as Environment Variables​

Create a Secret​

kubectl create secret generic db-secret \
  --from-literal=username=admin \
  --from-literal=password=secret123

Create a Pod with a Secret​

Create pod-secret-env.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-secret
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "echo 'DB_USER: $DB_USERNAME' && echo 'DB_PASS: $DB_PASSWORD' && sleep 3600"]
    env:
    - name: DB_USERNAME
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: username
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password

Deploy and Verify​

kubectl apply -f pod-secret-env.yaml
kubectl logs app-pod-secret

Exercise 5: Secrets as a Volume​

Create a Pod with a Secret Volume​

Create pod-secret-volume.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod-secret-vol
spec:
  containers:
  - name: app
    image: busybox:1.35
    command: ["sh", "-c", "ls -la /etc/secrets && cat /etc/secrets/username && sleep 3600"]
    volumeMounts:
    - name: secrets
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: db-secret
      defaultMode: 0400

Deploy and Verify​

kubectl apply -f pod-secret-volume.yaml
kubectl logs app-pod-secret-vol

Exercise 6: Complete Configuration​

Create ConfigMap and Secret​

kubectl create configmap app-config \
  --from-literal=app_name=MyApp \
  --from-literal=environment=production

kubectl create secret generic app-secret \
  --from-literal=api_key=secret-api-key-123

Create a Complete Deployment​

Create deployment-complete.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: app
        image: nginx:1.20
        env:
        - name: APP_NAME
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: app_name
        - name: ENVIRONMENT
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: environment
        - name: API_KEY
          valueFrom:
            secretKeyRef:
              name: app-secret
              key: api_key
        volumeMounts:
        - name: config
          mountPath: /etc/config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: app-config

Deploy and Verify​

kubectl apply -f deployment-complete.yaml
kubectl get pods -l app=myapp
kubectl exec <pod-name> -- env | grep -E 'APP|ENV|API'

Cleanup​

kubectl delete pod app-pod-env app-pod-envfrom nginx-pod app-pod-secret app-pod-secret-vol
kubectl delete deployment app-deployment
kubectl delete configmap app-config nginx-config
kubectl delete secret db-secret app-secret

Reflection Questions​

  1. What is the difference between env and envFrom?
  2. When should you use a ConfigMap volume vs environment variables?
  3. Why use readOnly: true for secret volumes?
  4. How do ConfigMap changes affect existing Pods?

Lab created: December 2024