Skip to main content

Chapter 5.3 - Injection into Pods

Learning Objectives​

By the end of this chapter, you will be able to:

  • Inject ConfigMaps as environment variables
  • Mount ConfigMaps as volumes
  • Use Secrets securely
  • Understand the different injection methods
  • Choose the right method based on the use case

Overview​

There are several ways to inject ConfigMaps and Secrets into your Pods. Each method has its own advantages and specific use cases.

Injection Methods​

1. Environment Variables​

From ConfigMap​

apiVersion: v1
kind: Pod
metadata:
  name: configmap-env-pod
spec:
  containers:
  - name: app
    image: nginx:1.20
    env:
    # Method 1: A specific key
    - name: DATABASE_URL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: database_url
    # Method 2: All keys
    - name: CONFIGMAP_ENV
      valueFrom:
        configMapRef:
          name: app-config
    envFrom:
    # Method 3: All ConfigMap keys
    - configMapRef:
        name: app-config

From Secret​

env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: db-secret
      key: password
envFrom:
- secretRef:
    name: db-secret

2. Volumes​

ConfigMap as a Volume​

apiVersion: v1
kind: Pod
metadata:
  name: configmap-volume-pod
spec:
  containers:
  - name: app
    image: nginx:1.20
    volumeMounts:
    - name: config
      mountPath: /etc/config
      readOnly: true
  volumes:
  - name: config
    configMap:
      name: app-config
      # Optional: include only certain keys
      items:
      - key: database_url
        path: db-url
      - key: log_level
        path: log-level

Secret as a Volume​

volumes:
- name: secrets
  secret:
    secretName: db-secret
    defaultMode: 0400  # Permissions (read-only)

Complete Example​

apiVersion: v1
kind: Pod
metadata:
  name: full-example-pod
spec:
  containers:
  - name: app
    image: my-app:1.0
    # Environment variables from ConfigMap
    env:
    - name: LOG_LEVEL
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: log_level
    # Environment variables from Secret
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password
    # ConfigMap volume
    volumeMounts:
    - name: config
      mountPath: /etc/config
    - name: secrets
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: config
    configMap:
      name: app-config
  - name: secrets
    secret:
      secretName: db-secret

Differences: env vs volumeMounts​

Environment Variables (env)​

Advantages:

  • Simple to use
  • Accessible via $VARIABLE_NAME
  • Good for simple values

Limitations:

  • No complete files
  • Size limit

Volumes​

Advantages:

  • Complete files
  • Directory structure
  • Good for configuration files

Use cases:

  • Configuration files (nginx.conf, etc.)
  • Certificates
  • Scripts

Best Practices​

ConfigMaps​

  • Use volumes for configuration files
  • Use env for simple values
  • Do not store sensitive data

Secrets​

  • Always use readOnly: true for volumes
  • Never log secret values
  • Use restrictive permissions (defaultMode: 0400)

Summary​

In this chapter, you learned:

Environment variables: env and envFrom
Volumes: configMap and secret as volumes
Methods: valueFrom, configMapRef, secretRef
Use cases: env for simple values, volumes for files
Security: readOnly, restrictive permissions for secrets

Next Steps​

Chapter 5.4: Best Practices
Lab 5.1: Creating and Using ConfigMaps

Chapter created: December 2024