Room 21

CONFIGMAPS

The Config Vault

Hard-coding config in containers is a sin. ConfigMaps separate config from code.
A deployment reads its config from a ConfigMap - update it to reveal the password.

📜 Mission Briefing

Examine configmap.yaml - it defines a ConfigMap with key-value pairs.
Apply it and deploy the pod that mounts it.
The ConfigMap has a key password with value configmap.
Exec into the pod and read the mounted config file.
The password is configmap.

Key Commands

Command	Purpose
`kubectl create configmap NAME --from-literal=key=value`	Create from literal
`kubectl create configmap NAME --from-file=FILE`	Create from file
`kubectl get cm`	List ConfigMaps
`kubectl describe cm NAME`	ConfigMap contents
`kubectl get cm NAME -o yaml`	Full YAML

How ConfigMaps Work

# Create ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  # Key-value pairs
  DATABASE_HOST: "mysql.default.svc"
  DATABASE_PORT: "3306"
  LOG_LEVEL: "info"
  # Multi-line config file
  app.properties: |
    server.port=8080
    spring.profiles.active=production
    password=configmap

# Mount as environment variables
apiVersion: v1
kind: Pod
metadata:
  name: config-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ['sh', '-c', 'env && sleep 3600']
      env:
        - name: DB_HOST
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: DATABASE_HOST
      envFrom:              # Load ALL keys as env vars
        - configMapRef:
            name: app-config

# Mount as volume (files)
apiVersion: v1
kind: Pod
metadata:
  name: config-vol-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ['sh', '-c', 'cat /config/app.properties && sleep 3600']
      volumeMounts:
        - name: config-volume
          mountPath: /config
  volumes:
    - name: config-volume
      configMap:
        name: app-config

# Create from command line
kubectl create configmap my-config \
  --from-literal=key1=value1 \
  --from-literal=key2=value2

# Create from a file
kubectl create configmap nginx-conf --from-file=nginx.conf

# Create from a directory (each file becomes a key)
kubectl create configmap app-config --from-file=config-dir/

# ConfigMaps are NOT encrypted - use Secrets for sensitive data
# ConfigMaps are namespaced resources
# Max size: 1 MiB

Hints

Hint 1

Apply and read:

kubectl apply -f configmap.yaml
kubectl apply -f config-pod.yaml

Hint 2

Read the mounted config:

kubectl exec config-pod -- cat /config/app.properties

Hint 3

The password is configmap.

🔓 Unlock Room 22

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_22/README             \
        -out ../room_22/README.txt        \
        -pass pass:PASSWORD
cat ../room_22/README.txt