ConfigMaps and Secrets

One image, many environments

Configuration belongs outside the image so the same artefact runs in staging and production. Config maps hold non-sensitive values; secrets hold credentials and are handled with a little more care.

Secrets are base64-encoded, not encrypted, by default. Anyone who can read the object can read the value, so real protection comes from access control and encryption at rest — plus an external secret manager if you need more.

Values injected as environment variables are read once at start. Mounting as files allows updates without a restart, if your application watches the file.