ConfigMap vs Secret in Kubernetes
In Kubernetes, decoupling configuration artifacts from image content is a best practice. ConfigMaps and Secrets are the two primary resources used for this purpose. While they share similar deployment mechanisms (mounted as volumes or environment variables), they serve fundamentally different purposes regarding security and data handling.
ConfigMap
Non-Confidential Configuration
Strengths
- •Ideal for storing plain-text configuration data (e.g., application.properties, nginx.conf)
- •Clear, readable manifests
- •Easy to update and hot-reload in applications
Weaknesses
- •No built-in security or obfuscation
- •Data is visible to anyone who can read the ConfigMap object
- •Subject to a 1MB size limit (etcd limitation)
Best For:
Environment variables, configuration files, and command-line arguments that do not contain sensitive data.
Secret
Sensitive Data Storage
Strengths
- •Obfuscates data using Base64 encoding
- •Can be encrypted at rest in etcd (when configured by the cluster admin)
- •Integrates well with external secret managers (via CSI drivers)
- •RBAC can be strictly applied to prevent unauthorized access
Weaknesses
- •Base64 encoding is NOT encryption (often misunderstood)
- •Also subject to the 1MB etcd limit
- •Requires extra cluster configuration (EncryptionConfiguration) to actually be secure at rest
Best For:
Passwords, OAuth tokens, SSH keys, TLS certificates, and other confidential data.
Feature Comparison
| Aspect | ConfigMap | Secret |
|---|---|---|
| Intended Data Type | Non-sensitive configuration data | Sensitive credentials and keys |
| Data Encoding in Manifest | Plain text | Base64 encoded |
| Storage in etcd (Default) | Plain text | Plain text (Base64 decoded) |
| Encryption at Rest Capability | No | Yes (Requires cluster admin setup) |
| Usage Mechanisms | Env vars, Volume mounts | Env vars, Volume mounts, ImagePullSecrets |
| Size Limit | 1MB | 1MB |
Architecture Rule of Thumb
A critical production misconception is assuming Kubernetes Secrets are encrypted by default. They are only Base64-encoded manifests stored in plaintext within etcd. Production hardening requires configuring KMS-based "Encryption at Rest" on the kube-apiserver or syncing secrets from HashiCorp Vault / cloud secret managers via External Secrets Operator.
Common Mistakes
- •Stating that Base64 encoding provides encryption or security.
- •Assuming Secrets are automatically encrypted in etcd.
- •Putting large files (>1MB) into ConfigMaps instead of using a proper storage volume.
Related Topics
That's where we come in.
Being able to explain when you would choose ConfigMap or Secret is different from reading a comparison table.
Kernelry helps you rehearse technical questions, evidence-led debugging, safe next steps, and the clear communication teams expect. The drills adapt to your answer, so you practice the reasoning rather than memorize a company-specific script. During early access, free accounts include ten daily scenarios across our mixed question pool, with no credit card required.