What is ConfigMaps?

• According to kubernetes.io, a ConfigMap is an API object used to store non-confidential data in key-value pairs.

• ConfigMaps are used to store configuration data that can be consumed by pods or other Kubernetes resources.

• ConfigMaps are typically used to store non-sensitive configuration data such as environment variables, command-line arguments, or configuration files. This data can be accessed by pods as environment variables or mounted as files.

• A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB.

• There are four different ways that you can use a ConfigMap to configure a container inside a Pod:

  1. Inside a container command and args

  2. Environment variables for a container

  3. Add a file in read-only volume, for the application to read

  4. Write code to run inside the Pod that uses the Kubernetes API to read a ConfigMap

What is Secrets?

• According to kubernetes.io, a Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key.

• Secrets are used to store sensitive information such as passwords, API keys, and TLS certificates. Secrets provide a secure way to store and manage this confidential data within a cluster. They are similar to ConfigMaps but are specifically designed to handle sensitive information.

• There are three main ways for a Pod to use a Secret:

  1. As files in a volume mounted on one or more of its containers.

  2. As container environment variable.

  3. By the kubelet when pulling images for the Pod.

Difference between ConfigMaps and Secrets in Kubernetes.

Let's start with the tasks now to learn and master ConfigMaps and Secrets.

Tasks 1

Create a ConfigMap for your Deployment.

• Let's create a mysql-config.yml file.

    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: todo-app
      labels:
        app: todo-app
      namespace: todo-app
    data:
      MYSQL_DB: "database_todo"
  

• This YAML file creates a ConfigMap object that stores a single configuration setting, MYSQL_DBwith the value "database_todo". This ConfigMap can be used by a pod in the deploy1 namespace to access this configuration setting as an environment variable or a file in a mounted volume.

• Now apply the configmap.yml file to your deployment.

    kubectl apply -f configmap.yml
    kubectl get configmap -n <namespace> #To verify the ConfigMap creation
  

  

• The ConfigMap is created successfully.

Task 2

Create a Secret for your Deployment

Before creating Secrets, let us encrypt the username and password.

• For example, I have taken password= test@123

• In your terminal, using base64 you can encode and decode:

•   echo -n 'test@123' | base64
  

  

• You can verify the encrypted characters by using the following:

    echo dGVzdEAxMjM= | base64 --decode
  

  

• What is base64?

  Base64 is a binary-to-text encoding scheme that represents binary data in sequences of 24 bits that can be represented by four 6-bit Base64 digits.

  It is always better to not use hardcoded values for data like usernames and passwords.

  I am going to use these encoded characters in the mysql-secret.yml file that I am going to create now.

  COPY

    apiVersion: v1
    kind: Secret
    metadata:   
      name: my-secret
      namespace: todo-app
    type: Opaque
    data:
      password: dGVzdEAxMjM=
  

• This YAML file creates a Secret object that stores a single piece of sensitive data, passwordwith the value admin@123. This Secret can be used by a pod in the deploy1 namespace to access this sensitive data as an environment variable or a file in a mounted volume. The value is encoded in base64 format to protect it from being exposed accidentally or stored in a terminal log.

• What's the type: Opaque mentioned here in the above code block?

  In Kubernetes, type: Opaque is the default type for a Secret object.

  It means that the contents of the Secret are unstructured and can contain arbitrary key-value pairs.

  Opaque Secrets are used to store arbitrary user-defined data, such as passwords, OAuth tokens, and ssh keys.

  Other types of Secrets include Service account token secrets (store a token that references a service account.), Docker registry secrets (store credentials for accessing a Docker registry), and TLS secrets (store TLS certificates and keys).

• Let's apply the secret to deployment.

    kubectl apply -f mysql-secret.yaml -n <namespace>
  

• We can verify the creation of secrets using:

    kubectl get secrets -n <namespace>
  

  

• Update the sqldeployment.yml with the secrets and config map.

     apiVersion: apps/v1
     kind: Deployment
     metadata:
       name: mysql-configuration
       labels:
         app: mysql
       namespace: todo-app 
     spec:
       replicas: 2
       selector:
         matchLabels:
           app: mysql
       template:
         metadata:
           labels:
             app: mysql
         spec:
           containers:
           - name: mysql-container
             image: mysql:8
             ports:
             - containerPort: 3306
             env:
             - name: MYSQL_ROOT_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: my-secret
                   key: password
             - name: MYSQL_DATABASE
               valueFrom:
                 configMapKeyRef:
                   name: my-configmap
                   key: MYSQL_DB
  

• Let's apply this to the cluster.

    kubectl apply -f sqldeployment.yaml
  

• Let's verify if the pods are running.

    kubectl get pods -n <namespace>
  

  

  pods are created.

• we need to use the MySQL service. For that, we will have to expose the k8s cluster to a port. I will create a sqlservice.yaml for that.

     apiVersion: v1
     kind: Service
     metadata:
       name: mysql-service-configuration
       namespace: todo-app
     spec:
       ports:
       - name: mysql
         port: 3306
       clusterIP: None
       selector:
         app: mysql
  

• And apply to the cluster.

    kubectl apply -f sqlservice.yaml
  

• Get inside the worker node and install the MYSQL client.

    sudo apt install mysql-client-core-8.0
  

• Now on the controller, connect to any node:

    kubectl exec -it mysql-configuration-858b8c57ff-g87gz /bin/sh -n todo-app
  

• Connect using the username and password you gave in the secret.yml file.

     mysql -u root -p${MYSQL_ROOT_PASSWORD}
  

• Now we are in the MYSQL console. We can see the databases in the container using show databases;

  

#Day35 #90daysofdevops

Thankyou.....