What are ConfigMaps and Secrets?
Interviewer Expectations for this Question
01
Core Competency
Assesses fundamental understanding of Kubernetes conventions, runtime behavior, and memory/performance considerations.
02
Evaluation Criteria
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Comprehensive Model Answer
Verified Solution
Both decouple configuration from container images, but they differ in intent and handling.
- ConfigMap: non-sensitive key-value data or files. Consume it as environment variables or mounted volumes.
- Secret: sensitive data such as passwords, tokens, and certificates. Stored base64-encoded, and by default not encrypted at rest unless you enable encryption or use a KMS provider. Restrict access with RBAC.
apiVersion: v1
kind: ConfigMap
metadata: {name: app-config}
data:
LOG_LEVEL: info
---
apiVersion: v1
kind: Secret
metadata: {name: app-secret}
type: Opaque
stringData:
DB_PASSWORD: change-me
kubectl create configmap app-config --from-file=config.yaml
kubectl create secret generic app-secret --from-literal=DB_PASSWORD=change-me
Mount as volumes when you want automatic updates; environment variables do not refresh. Avoid committing Secrets to Git, and use External Secrets or Sealed Secrets instead.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.