Secrets & ConfigMaps

Externalising configuration and protecting sensitive data in Helm charts

• ConfigMaps for non-sensitive configuration
• Secrets for credentials, tokens, and keys
• Mounting strategies: volumes vs environment variables
• External secrets patterns for production security
• Automatic rollout on config change

ConfigMaps in Helm

ConfigMaps decouple configuration from container images. Helm templates them from values.yaml or external files.

# templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "myapp.fullname" . }}-config
  labels:
    {{- include "myapp.labels" . | nindent 4 }}
data:
  APP_ENV: {{ .Values.config.env | quote }}
  LOG_LEVEL: {{ .Values.config.logLevel | quote }}
  # Load an entire file from the chart
  nginx.conf: |-
{{ .Files.Get "files/nginx.conf" | indent 4 }}

Mounting ConfigMaps

env:
  - name: APP_ENV
    valueFrom:
      configMapKeyRef:
        name: {{ include "myapp.fullname" . }}-config
        key: APP_ENV
# Or load all keys at once:
envFrom:
  - configMapRef:
      name: {{ include "myapp.fullname" . }}-config

volumes:
  - name: config-vol
    configMap:
      name: {{ include "myapp.fullname" . }}-config
containers:
  - volumeMounts:
      - name: config-vol
        mountPath: /etc/myapp
        readOnly: true

Secrets in Helm

Kubernetes supports three common Secret types: Opaque, kubernetes.io/tls, and kubernetes.io/dockerconfigjson.

# templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "myapp.fullname" . }}-secret
type: Opaque
# Option A: base64-encoded data
data:
  DB_PASSWORD: {{ .Values.secrets.dbPassword | b64enc | quote }}
# Option B: plaintext stringData (Kubernetes base64-encodes it)
stringData:
  API_KEY: {{ .Values.secrets.apiKey | quote }}

The Plaintext Problem

Solutions

• External Secrets Operator — ExternalSecret CRD syncs from Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager
• Sealed Secrets — Encrypt secrets client-side with kubeseal; only the cluster can decrypt
• Helm Secrets plugin — helm secrets wraps SOPS/age to encrypt values files before committing
• CSI Secrets Store Driver — Mount vault secrets directly as volumes, no K8s Secret object needed

External Secrets Pattern

# templates/external-secret.yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: {{ include "myapp.fullname" . }}-es
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: {{ include "myapp.fullname" . }}-secret
    creationPolicy: Owner
  data:
    - secretKey: DB_PASSWORD
      remoteRef:
        key: prod/myapp/db
        property: password
    - secretKey: API_KEY
      remoteRef:
        key: prod/myapp/api
        property: key

Immutable Resources & Rollout Tricks

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "myapp.fullname" . }}-config
immutable: true
data:
  APP_ENV: {{ .Values.config.env | quote }}

# templates/deployment.yaml
spec:
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}

Secret Rotation Patterns

• External Secrets Operator — Set refreshInterval to poll the vault periodically (e.g., 15m)
• Reloader — Open-source controller that watches ConfigMaps/Secrets and triggers rolling updates on change
• Dual-secret rotation — Keep old + new credentials valid during rollout; retire old after all pods are updated
• CSI rotation — Secrets Store CSI driver supports rotationPollInterval for mounted volumes

Key Takeaways

1. ConfigMaps for non-sensitive config; Secrets for credentials
2. Never commit plaintext secrets to Git — use External Secrets or Sealed Secrets
3. Use the checksum annotation to auto-roll pods on config changes
4. Plan for secret rotation from day one