ConfigMaps

Externalizing Configuration

A ConfigMap stores non-secret configuration as key-value data, keeping settings out of images so the same image promotes from staging to production unchanged:

kubectl create configmap app-config \
  --from-literal=LOG_LEVEL=info \
  --from-literal=FEATURE_X=true \
  --from-file=nginx.conf

Values are limited to about 1 MiB per object (the etcd request cap) and keys must match [-._a-zA-Z0-9]+. ConfigMaps are namespace-scoped, so each environment gets its own copy rather than branching on conditionals inside the app.

They are not containers' filesystem by default — you choose how pods consume them: environment variables, volume mounts, or the Downward API. That choice determines how (or whether) changes reach running processes.

Consuming a ConfigMap

spec:
  containers:
  - name: app
    image: nginx:1.27
    envFrom:
    - configMapRef: { name: app-config }        # every key as env var
    env:
    - name: LOG_LEVEL
      valueFrom: { configMapKeyRef: { name: app-config, key: LOG_LEVEL } }
    volumeMounts:
    - { name: cfg, mountPath: /etc/nginx/nginx.conf, subPath: nginx.conf }
  volumes:
  - name: cfg
    configMap: { name: app-config }

Mounted files update in place within seconds (kubelet syncs), but apps must re-read or watch them; environment variables are injected only at container start, so a ConfigMap change never reaches an already-running process.

subPath mounts a single key and — important detail — does not receive in-place updates.

Pitfalls and Interview Angles

Pitfall 1 — expecting env vars to refresh. They are snapshot at start; changing the ConfigMap requires a restart, typically by annotating the pod template with the ConfigMap's resourceVersion to trigger a new rollout.

Pitfall 2 — secrets in ConfigMaps. Anything sensitive (tokens, passwords) belongs in a Secret — ConfigMaps are stored and displayed as plain text in etcd and in kubectl get -o yaml.

Interview-ready: contrast the three consumption methods with the restart implication, explain the 1 MiB limit and immutable ConfigMaps (immutable: true for stable files, with the tradeoff that changes need a new object and pod restart), and describe your update strategy: bump the template annotation to force recreation.