How to Use Kubernetes ConfigMap and Secret in Deployment (Step by Step)

Introduction

When working with Kubernetes, one of the most important practices is separating your application code from configuration data. In real-world projects, applications need different configurations depending on environments like development, testing, or production.

For example, your application may need:

Database connection strings
API keys
Environment-specific URLs

Instead of hardcoding these values inside your application, Kubernetes provides two powerful tools:

ConfigMap → for non-sensitive data
Secret → for sensitive data like passwords and tokens

In this article, we will understand how to use Kubernetes ConfigMap and Secret in a deployment step by step in simple words with practical examples.

What is a ConfigMap in Kubernetes?

A ConfigMap is used to store non-sensitive configuration data in key-value format.

Simple understanding

Think of ConfigMap as a settings file for your application.

Instead of writing configuration inside your code, you store it separately and Kubernetes injects it into your application when needed.

Example use cases

Application environment variables
App settings (like log level)
URLs and feature flags

What is a Secret in Kubernetes?

A Secret is used to store sensitive data securely.

Simple understanding

Think of Secret as a locked version of ConfigMap.

It stores:

Passwords
API keys
Tokens

Kubernetes encodes this data (base64) and allows controlled access.

Key Difference Between ConfigMap and Secret

ConfigMap → Non-sensitive data
Secret → Sensitive data

Both are used in a similar way inside deployments.

Step-by-Step: Using ConfigMap in Kubernetes Deployment

Let’s start with ConfigMap.

Step 1: Create a ConfigMap YAML File

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: production
  APP_DEBUG: "false"
  API_URL: "https://api.example.com"

What this means

data contains key-value pairs
These values will be injected into the container

Step 2: Apply ConfigMap to Kubernetes

Run this command:

kubectl apply -f configmap.yaml

Now your ConfigMap is created inside the cluster.

Step 3: Use ConfigMap in Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-container
        image: nginx
        envFrom:
        - configMapRef:
            name: app-config

What is happening here

envFrom loads all ConfigMap values as environment variables
Your app can access them directly

Step-by-Step: Using Secret in Kubernetes Deployment

Now let’s handle sensitive data.

Step 4: Create Secret YAML File

Before creating a secret, values must be base64 encoded.

Example:

username → admin → YWRtaW4=
password → 12345 → MTIzNDU=

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
type: Opaque
data:
  DB_USERNAME: YWRtaW4=
  DB_PASSWORD: MTIzNDU=

Step 5: Apply Secret to Kubernetes

kubectl apply -f secret.yaml

Step 6: Use Secret in Deployment

envFrom:
- secretRef:
    name: app-secret

Or use individually:

env:
- name: DB_USERNAME
  valueFrom:
    secretKeyRef:
      name: app-secret
      key: DB_USERNAME

Combined Example: ConfigMap + Secret in One Deployment

containers:
- name: my-container
  image: nginx
  envFrom:
  - configMapRef:
      name: app-config
  - secretRef:
      name: app-secret

Real-world scenario

ConfigMap → App settings
Secret → Database credentials

Accessing Values Inside Application

Inside your application, you can read these as environment variables.

Example in Node.js:

process.env.APP_ENV
process.env.DB_USERNAME

Best Practices

Never store secrets in plain text in code
Use Secrets for passwords and tokens
Use ConfigMaps for general configuration
Keep configuration environment-specific

Advantages

Improves security
Keeps application flexible
Easy to update configs without changing code
Supports cloud-native best practices

Disadvantages

Secrets are only base64 encoded (not fully encrypted by default)
Requires proper access control
Slight learning curve for beginners

When to Use ConfigMap vs Secret

Use ConfigMap when:

Data is not sensitive
Configuration is shared across services

Use Secret when:

Data is sensitive
Security is important

Summary

Kubernetes ConfigMap and Secret help you separate configuration from application code, making your deployments cleaner, more secure, and easier to manage. ConfigMap is ideal for storing non-sensitive settings, while Secret is used for sensitive information like passwords and API keys. By using both together in your deployments, you can build scalable, secure, and production-ready Kubernetes applications. Understanding how to use them step by step is essential for anyone working with modern DevOps and cloud-native systems.