Managing Secrets and ConfigMaps in OpenShift: Secure App Configuration

Modern applications rely on configuration values and sensitive data such as API keys, database credentials, and certificates. Storing these directly in code or container images creates serious security risks.

OpenShift addresses this challenge with Secrets and ConfigMaps, enabling secure, dynamic, and scalable configuration management. These resources allow applications to consume data at runtime without exposing sensitive information.

🔑 Secrets in OpenShift

Secrets are used to store sensitive information in a secure, encoded format.

🔹 Key Features

• Stores credentials, tokens, and certificates
• Encoded using base64 (not encryption by default)
• Can be mounted as environment variables or files

📌 Example Secret

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: cmNoX3VzZXI=
  password: c2VjdXJlX3Bhc3M=

🔹 Usage

Secrets can be injected into pods as:

• Environment variables
• Mounted volumes

📑 ConfigMaps in OpenShift

ConfigMaps store non-sensitive configuration data, separating configuration from application logic.

🔹 Key Features

• Stores environment-specific settings
• Enables dynamic updates without rebuilding images
• Supports key-value pairs or full config files

📌 Example ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  LOG_LEVEL: "debug"
  FEATURE_FLAG: "true"

🔧 Using Secrets and ConfigMaps in Pods

You can inject both Secrets and ConfigMaps into containers using environment variables:

env:
- name: DB_USER
  valueFrom:
    secretKeyRef:
      name: db-credentials
      key: username
- name: LOG_LEVEL
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: LOG_LEVEL

This approach keeps application code clean while securely managing configuration.

🧪 Troubleshooting Tips

• Use oc get secrets and oc get configmaps to list resources

• Inspect environment variables:

   

  oc exec <pod> -- env

   
• Verify base64 encoding for Secret values
• Check RBAC permissions if access issues occur

✅ Best Practices

✔ Never hardcode credentials in application code
✔ Use RBAC to restrict access to Secrets
✔ Rotate secrets regularly
✔ Separate sensitive (Secrets) and non-sensitive data (ConfigMaps)
✔ Use external secret managers for production-grade security

📌 Conclusion

Secrets and ConfigMaps are fundamental to secure and scalable application deployment in Kubernetes environments like OpenShift. By separating configuration from code and securing sensitive data, organizations can improve security posture while maintaining operational flexibility.