Skip to content

Configuration — Example Manifests

simple-configmap.yaml — Basic ConfigMap

# ConfigMap with key-value pairs
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  # Simple key-value pairs
  database_host: "postgres.default.svc.cluster.local"
  database_port: "5432"
  database_name: "myapp"
  log_level: "info"
  max_connections: "100"
---
# Deployment using ConfigMap as environment variables
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: nginx
        image: nginx:1.25-alpine
        env:
        # Individual environment variables from ConfigMap
        - name: DB_HOST
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: database_host
        - name: DB_PORT
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: database_port
        - name: DB_NAME
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: database_name
        # All keys from ConfigMap as environment variables
        envFrom:
        - configMapRef:
            name: app-config

configmap-volume.yaml — ConfigMap mounted as a volume

# ConfigMap with file-like data
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  # Configuration file content
  nginx.conf: |
    user nginx;
    worker_processes auto;

    events {
        worker_connections 1024;
    }

    http {
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';

        access_log /var/log/nginx/access.log main;
        sendfile on;
        keepalive_timeout 65;

        server {
            listen 80;
            server_name localhost;

            location / {
                root /usr/share/nginx/html;
                index index.html;
            }

            location /health {
                access_log off;
                return 200 "healthy\n";
                add_header Content-Type text/plain;
            }
        }
    }

  index.html: |
    <!DOCTYPE html>
    <html>
    <head>
        <title>ConfigMap Demo</title>
    </head>
    <body>
        <h1>Configuration from ConfigMap</h1>
        <p>This page is served from a ConfigMap volume mount.</p>
    </body>
    </html>
---
# Deployment mounting ConfigMap as volume
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-with-config
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.25-alpine
        ports:
        - containerPort: 80
        volumeMounts:
        # Mount entire ConfigMap as directory
        - name: config-volume
          mountPath: /etc/nginx/nginx.conf
          subPath: nginx.conf
        - name: config-volume
          mountPath: /usr/share/nginx/html/index.html
          subPath: index.html
      volumes:
      - name: config-volume
        configMap:
          name: nginx-config

secrets.yaml — Kubernetes Secrets

# Secret for sensitive data
# Note: Values must be base64 encoded
# echo -n 'mypassword' | base64
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=           # admin
  password: bXlwYXNzd29yZA==   # mypassword
  connection-string: cG9zdGdyZXM6Ly9hZG1pbjpteXBhc3N3b3JkQHBvc3RncmVzOjU0MzIvbXlhcHA=
---
# Secret using stringData (no encoding needed)
apiVersion: v1
kind: Secret
metadata:
  name: api-keys
type: Opaque
stringData:
  api-key: "sk-1234567890abcdef"
  api-secret: "secret-key-here"
  webhook-token: "webhook-token-123"
---
# Deployment using Secrets
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-with-secrets
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: app
        image: busybox:1.36
        command: ["/bin/sh", "-c"]
        args:
          - |
            echo "App started with credentials:"
            echo "Username: $DB_USERNAME"
            echo "API Key: $API_KEY"
            echo "Reading connection string from file:"
            cat /etc/secrets/connection-string
            echo ""
            echo "Sleeping..."
            sleep 3600
        env:
        # Individual secrets as environment variables
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: username
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: password
        # All keys from another secret
        envFrom:
        - secretRef:
            name: api-keys
            prefix: API_
        volumeMounts:
        # Mount secrets as files
        - name: db-secret-volume
          mountPath: /etc/secrets
          readOnly: true
      volumes:
      - name: db-secret-volume
        secret:
          secretName: db-credentials
          items:
          - key: connection-string
            path: connection-string

compose.yaml — Docker Compose comparison

# Docker Compose equivalent for ConfigMaps and Secrets
# Compose uses environment variables and config files similarly

services:
  # Using environment variables (like ConfigMap)
  web:
    image: nginx:1.25-alpine
    environment:
      # Direct values (similar to ConfigMap data)
      DB_HOST: postgres.default.svc.cluster.local
      DB_PORT: "5432"
      DB_NAME: myapp
      LOG_LEVEL: info
      MAX_CONNECTIONS: "100"
    # Or from .env file
    # env_file:
    #   - ./config.env
    deploy:
      replicas: 2

  # Using config files (similar to ConfigMap volumes)
  nginx-custom:
    image: nginx:1.25-alpine
    configs:
      - source: nginx_config
        target: /etc/nginx/nginx.conf
      - source: index_html
        target: /usr/share/nginx/html/index.html
    deploy:
      replicas: 2

  # Using secrets (similar to K8s Secrets)
  app-with-secrets:
    image: busybox:1.36
    command: >
      sh -c "echo App started with credentials:
             echo Username: $$DB_USERNAME
             echo Reading connection string:
             cat /run/secrets/connection-string
             sleep 3600"
    environment:
      DB_USERNAME: admin
    secrets:
      - db_password
      - connection-string
      - api-key
    deploy:
      replicas: 2

# Config definitions (like ConfigMaps)
configs:
  nginx_config:
    file: ./nginx.conf
  index_html:
    content: |
      <!DOCTYPE html>
      <html>
      <head><title>ConfigMap Demo</title></head>
      <body>
        <h1>Configuration from Config</h1>
        <p>This is similar to K8s ConfigMap.</p>
      </body>
      </html>

# Secret definitions (like K8s Secrets)
secrets:
  db_password:
    file: ./db_password.txt
  connection-string:
    external: true  # Externally defined
  api-key:
    environment: "API_KEY"  # From environment variable

# Key Differences:
# 
# 1. ConfigMap/Environment Variables:
#    Compose: environment: key=value or env_file
#    K8s: ConfigMap → envFrom or env with configMapKeyRef
# 
# 2. Configuration Files:
#    Compose: configs: mounted at specified target path
#    K8s: ConfigMap → volumeMounts with volumes
# 
# 3. Secrets:
#    Compose: secrets: mounted in /run/secrets/ by default
#    K8s: Secret → env (secretKeyRef) or volumeMounts
# 
# 4. External References:
#    Compose: external: true (must exist before deployment)
#    K8s: References by name (must exist in same namespace)
# 
# 5. Updates:
#    Compose: Requires service restart for env vars
#    K8s: ConfigMap/Secret changes auto-update volumes (env needs restart)
# 
# 6. Security:
#    Compose: Secrets in /run/secrets/ (tmpfs)
#    K8s: Secrets in tmpfs, RBAC-controlled, can be encrypted at rest