~/ nmadiraju.com Amazon EKS · ConfigMaps and Secrets
arrow_back Back to nmadiraju
Visual Walkthrough · Kubernetes configuration

How ConfigMaps and Secrets Work on Amazon EKS

Follow the web app as it gets its settings and a database password, then check yourself with 8 questions.

1Visual Walkthrough

web's Pod on an EKS node reading a ConfigMap and a Secret from the Kubernetes API, with RBAC, etcd and AWS KMS Amazon ECR and the dev-team sit on the left. node-1 runs the kubelet and web's Pod, with an app container showing its environment variables and a volume at /etc/web. The Kubernetes API holds ConfigMap web-config, Secret web-db, etcd encrypted with AWS KMS, and RoleBindings. The walkthrough shows settings baked into images, a ConfigMap as env vars and files, a change not reaching running Pods, a rollout, a password leaking from a ConfigMap, a Secret decoded from base64, and RBAC plus encryption at rest. Amazon ECR dev-team 12 developers kubectl node-1 · EC2 · 10.0.1.10 kubelet fetches config for its Pods Pod web-6c9d7-x2k4p ns shop app container environment variables volume at /etc/web app.yaml KUBERNETES API (EKS) ConfigMap web-config Secret web-db type: Opaque data: password: cGctOWZLMnE= base64 is encoding, not encryption etcd (run by EKS) stores every API object AWS KMS AWS owned key or your own key RoleBindings in shop (RBAC) ci-deployer: get Secrets, deploy web every kubectl request is authorized here

    2Quiz to check understanding

    Check yourself