ConfigMap basics

A Kubernetes ConfigMap stores non-confidential configuration data as key-value pairs. Pods consume ConfigMaps as environment variables (envFrom or env with valueFrom), command-line arguments, or mounted config files in a volume. ConfigMaps are namespace-scoped and limited to 1 MiB of data. They are not encrypted — use Secrets for sensitive values.

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  NODE_ENV: "production"
  PORT: "3000"
  LOG_LEVEL: "info"

Consuming ConfigMaps in Pods

Use envFrom to inject all ConfigMap keys as environment variables, or env with valueFrom.configMapKeyRef for individual keys. For file-based config, mount as a volume. envFrom is the fastest way to convert a .env workflow to Kubernetes — one line replaces dozens of individual env entries.

spec:
  containers:
    - name: app
      image: myapp:latest
      # Inject all keys as env vars
      envFrom:
        - configMapRef:
            name: app-config
      # Or pick individual keys
      env:
        - name: DATABASE_HOST
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: DB_HOST

ConfigMap vs Secret

Use ConfigMap for non-sensitive data: feature flags, log levels, service URLs, port numbers. Use Secret for passwords, tokens, certificates, and API keys. The converter auto-detects sensitive key names and flags them. In practice, many teams start with a ConfigMap for everything and gradually split sensitive values into Secrets as they harden their deployment.