Look inside a pod with its lid off: an env-var plugboard filled when the container starts, and a mounted file tray the kubelet refreshes. Edit the ConfigMap and see which one changes, or press ▶ Guided tour.
| Key | From | In the API | Env var in pod | File in pod |
|---|
A ConfigMap holds plain settings and a Secret holds sensitive ones; both are API objects stored in etcd. A pod can take their values as environment variables, copied in once when the container starts, or as files in a mounted volume, which the kubelet refreshes on its periodic sync. Editing a ConfigMap therefore changes mounted files after a delay but never the env vars of a running container. A Secret's values are only base64-encoded: limit who can read Secrets with RBAC and enable encryption at rest.