CKAD — ConfigMap vs Secret
less than 1 minute read
ConfigMap vs Secret: When to Use What
| Feature |
ConfigMap |
Secret |
| Use for |
Non-sensitive config |
Passwords, tokens, keys |
| Encoding |
Plain text |
Base64 encoded |
| Size limit |
1 MB |
1 MB |
| Env vars |
Yes (configMapRef) |
Yes (secretRef) |
| Volume mount |
Yes |
Yes |
| Immutable |
Yes |
Yes |
| Encryption at rest |
No |
Optional (EncryptionConfiguration) |
Updating Configuration
ConfigMap/Secret Update Behavior
| Method |
Update Behavior |
| Env vars |
NOT updated. Requires Pod restart. |
| Volume mount |
Auto-updated (within ~1 minute). No restart needed. |
# Update a ConfigMap
kubectl edit configmap app-config
# Or replace it
kubectl create configmap app-config \
--from-literal=LOG_LEVEL=debug \
--dry-run=client -o yaml | kubectl apply -f -
# If using env vars, restart the Pods
kubectl rollout restart deployment/web
← Previous: Logging & Debugging Next: Hands-On Lab →
