KeyFromIn the APIEnv var in podFile in pod
apiVersion: v1
kind: ConfigMap
metadata: { name: app }
data: { LOG_LEVEL: info, FEATURE_X: off }
---
kind: Secret
metadata: { name: db }
data: { password: aHVudGVyMg== }      # base64 of "hunter2"
---
kind: Pod        # excerpt
spec:
  containers:
  - env:
    - { name: LOG_LEVEL,   valueFrom: { configMapKeyRef: { name: app, key: LOG_LEVEL } } }
    - { name: DB_PASSWORD, valueFrom: { secretKeyRef: { name: db, key: password } } }
    volumeMounts: [{ name: config, mountPath: /etc/config }]
  volumes: [{ name: config, configMap: { name: app } }]
A delivery from the kubelet: new files on its periodic sync, env vars only on restartRed lamp: this env var no longer matches the ConfigMap; restart the pod to pick it upSecret: stored base64-encoded, which anyone with read access can decodeA ConfigMap holds plain settings and a Secret holds sensitive ones; both are API objects stored in etcd. A pod can take their values as environment variables, which are copied in once when the container starts, or as files in a mounted volume, which the kubelet refreshes on its periodic sync, so the app must re-read them. Editing a ConfigMap therefore changes mounted files after a delay but never the env vars of a running container. A Secret's values are only base64-encoded: limit who can read Secrets with RBAC and enable encryption at rest.
Next: Health probes →