ConfigMaps and Secrets play a pivotal role in Kubernetes for managing configuration data and safeguarding sensitive information. Let's delve into these critical components, understand how to use them, and explore their real-world significance.
What are ConfigMaps and Secrets?
ConfigMaps 📁
A ConfigMap is a Kubernetes object that stores configuration data as key-value pairs. A ConfigMap allows you to decouple the configuration data from the container image, making it easier to update and reuse. You can use a ConfigMap to store environment variables, configuration files, command-line arguments, or any other data that you want to pass to your containers.
Think of ConfigMaps as neatly labeled folders within a file cabinet. Each folder contains instructions or settings that help different parts of your spaceship (Kubernetes cluster) function efficiently.
To create a ConfigMap for your deployment, you need to define the key-value pairs that you want to store in the ConfigMap. You can do this using a file or the command line.
- To create a ConfigMap using a file, you need to create a YAML or JSON file that contains the key-value pairs. For example, you can create a file named config.yml with the following content:
apiVersion: v1
kind: ConfigMap
metadata:
name: mysql-config
data:
MYSQL_HOST: mysql
MYSQL_USER: root
MYSQL_DATABASE: mydb
- To create a ConfigMap using the command line, you need to use the
kubectl create configmap command with the --from-literal option. For example, you can run the following command:
kubectl create configmap mysql-config --from-literal=MYSQL_HOST=mysql --from-literal=MYSQL_USER=root --from-literal=MYSQL_DATABASE=todo_db
Secrets 🔐
A Secret is a Kubernetes object that stores sensitive data in an encrypted form. A Secret allows you to protect your data from unauthorized access or exposure. You can use a Secret to store passwords, tokens, keys, certificates, or any other data that you want to keep secret.
Imagine Secrets as a highly secured safe where you store your most valuable possessions. They are encrypted and protected, allowing only authorized personnel (containers) with the right clearance to access them.
To create a Secret for your deployment, you need to encode the data that you want to store in the Secret using base64 encoding. You can do this using a file or the command line.
- To create a Secret using a file, you need to create a YAML or JSON file that contains the encoded data. For example, you can create a file named secret.yml with the following content:
apiVersion: v1
kind: Secret
metadata:
name: mysql-secret
type: Opaque
data:
MYSQL_PASSWORD: YWRtaW4K
- To create a Secret using the command line, you need to use the kubectl create secret generic command with the --from-literal option. For example, you can run the following command:
kubectl create secret generic mysql-secret --from-literal=MYSQL_PASSWORD=root
Now, let's put these concepts into practice by setting up ConfigMaps and Secrets for a two-tier application running on Flask and MySQL within a Kubernetes cluster.
ConfigMaps and Secrets in a Two-Tier Application
In this example, we have a two-tier application consisting of a Flask backend and a MySQL database. We'll create ConfigMaps and Secrets to manage the configuration and sensitive data for these components.
Creating ConfigMaps for a Two-Tier Application
Step 1: Create a ConfigMap for your Deployment
Let's start by creating a ConfigMap for your Flask deployment. We'll define the configuration in a YAML file, mysql-config.yaml:
apiVersion: v1
kind: ConfigMap
metadata:
name: mysql-config
data:
MYSQL_HOST: mysql
MYSQL_USER: root
MYSQL_DATABASE: mydb
In this example, we define key-value pairs for the database URL, API key, and debug mode.
Step 2: Update the Flask deployment to include the ConfigMap
To use the ConfigMap in your deployment, you need to update the deployment.yml file to include the envFrom field under the spec.containers section. The envFrom field allows you to inject all the key-value pairs from the ConfigMap as environment variables into your containers.
For example, you can update your deployment.yml file for your Flask web server with the following content:
apiVersion: apps/v1
kind: Deployment
metadata:
name: two-tier-app
labels:
app: two-tier-app
spec:
replicas: 1
selector:
matchLabels:
app: two-tier-app
template:
metadata:
labels:
app: two-tier-app
spec:
containers:
- name: two-tier-app
image: 'trainwithshubham/flaskapp:latest'
envFrom: null
- configMapRef:
name: mysql-config
ports:
- containerPort: 5000
imagePullPolicy: Always
By referencing the ConfigMap mysql-config, your Flask application can access these configuration values.
Step 3: Apply the updated deployment
To apply the updated deployment to your cluster, you need to use the kubectl apply command with the -f option and specify the name of your deployment file. For example, you can run the following command:
kubectl apply -f two-tier-app-deployment.yml
Step 4: Verify that the ConfigMap has been created
To verify that the ConfigMap has been created, you can use the kubectl get configmaps command to list all the ConfigMaps. You should see something like this:
To inspect the details of a specific ConfigMap, you can use the kubectl describe configmap command with the name of the ConfigMap. For example, you can run the following command:
kubectl describe configmap mysql-config
You should see something like this:
Creating Secrets for a Two-Tier Application
Step 1: Create a Secret for your Deployment
Let's create a Secret to securely store the MySQL database credentials. Define the Secret in a YAML file, mysql-secret.yaml:
apiVersion: v1
kind: Secret
metadata:
name: mysql-secret
type: Opaque
data:
MYSQL_PASSWORD: YWRtaW4K
In this example, we encode the password to keep it secure.
Step 2: Update the MySQL deployment to include the Secret
To use the Secret in your deployment, you need to update the deployment.yml file to include the env field under the spec.containers section. The env field allows you to inject specific key-value pairs from the Secret as environment variables into your containers.
For example, you can update your deployment.yml file for your Flask web server with the following content:
apiVersion: apps/v1
kind: Deployment
metadata:
name: two-tier-app
labels:
app: two-tier-app
spec:
replicas: 1
selector:
matchLabels:
app: two-tier-app
template:
metadata:
labels:
app: two-tier-app
spec:
containers:
- name: two-tier-app
image: trainwithshubham/flaskapp:latest
envFrom:
- configMapRef:
name: mysql-config
env:
- name: MYSQL_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-secret
key: MYSQL_PASSWORD
Step 3: Apply the updated deployment
Apply the changes to your Kubernetes cluster:
kubectl apply -f two-tier-app-deployment.yml
Step 4: Verify that the Secret has been created
To verify that the Secret has been created, you can use the kubectl get secrets command to list all the Secrets. You should see something like this:
To inspect the details of a specific Secret, you can use the kubectl describe secret command with the name of the Secret. For example, you can run the following command:
kubectl describe secret mysql-secret
You should see something like this:
I've presented the two-tier deployment configuration here, but you can find all the configuration files for this project in the Git repository.
https://github.com/ajitfawade/two-tier-flask-app
Exploring Real-World Scenarios
The above steps demonstrate how to set up ConfigMaps and Secrets for a two-tier application. However, in real-world scenarios, you might encounter more complex requirements, such as dynamic updates, multiple namespaces, or external secrets management tools. The flexibility of Kubernetes allows you to adapt to these challenges efficiently.
Conclusion
In this blog post, we learned how to create ConfigMap and Secret for a two-tier application in Kubernetes. We saw how to create, update, and apply ConfigMap and Secret for our deployments using files or the command line. We also learned how to verify that our ConfigMap and Secret have been created and applied correctly by checking the status of our resources.
ConfigMap and Secret are essential tools for managing configuration data and secrets in Kubernetes. They help us keep our deployments consistent, secure, and scalable. By mastering ConfigMap and Secret, we can ensure that our Kubernetes clusters run smoothly and efficiently.
If you want to learn more about ConfigMap and Secret, you can check out these resources:
I hope you enjoyed this blog post on creating ConfigMap and Secret for a two-tier application in Kubernetes. Please leave your feedback or questions in the comments section below.
Happy sailing on your Kubernetes spaceship! 🌟
