> For the complete documentation index, see [llms.txt](https://dinush-chathurya.gitbook.io/kustomize-e-book/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dinush-chathurya.gitbook.io/kustomize-e-book/kustomize-fundamentals/06-configmap-and-secret-management.md).

# ConfigMap and Secret Management

Configuration is at the heart of any application deployment. Kustomize simplifies managing your `ConfigMaps` and `Secrets` across environments while maintaining security and DRY (Don't Repeat Yourself) principles.

***

## What Are ConfigMaps and Secrets?

* **ConfigMap**: Used for non-sensitive configuration like app settings, URLs, and feature flags.
* **Secret**: Used to store sensitive data such as passwords, tokens, and certificates (base64-encoded but not encrypted).

***

## Creating ConfigMaps with Kustomize

You can define a ConfigMap in Kustomize using either inline values or files.

### Inline ConfigMap Example

```yaml
# base/kustomization.yaml
configMapGenerator:
  - name: app-config
    literals:
      - ENV=production
      - LOG_LEVEL=info
```

Kustomize will generate a **ConfigMap** with a hashed name (e.g., `app-config-abc123`) for versioning.

### File-based ConfigMap Example

```yaml
configMapGenerator:
  - name: app-config
    files:
      - app.properties
```

Where `app.properties` might contain:

```ini
ENV=production
LOG_LEVEL=info
```

This is especially useful for maintaining large configuration files.

## Creating Secrets with Kustomize

You can generate secrets using `secretGenerator` (not encrypted—**use with caution** in Git repositories).

### Inline Secret Example

```yaml
# base/kustomization.yaml
secretGenerator:
  - name: db-secret
    literals:
      - DB_USER=admin
      - DB_PASS=supersecure
```

⚠️ Avoid storing secrets directly in your Git repository. Use sealed secrets or external secret managers in production.

## Best Practices

* Don’t commit secrets to **Git** – instead, use sealed secrets, HashiCorp Vault, or AWS Secrets Manager.
* Use environment-specific values by patching or overriding values in `overlays/`.

## Example Overlay Patch

Let’s say the base uses a default `LOG_LEVEL=info`, but in dev you want `LOG_LEVEL=debug`.

```yaml
# overlays/dev/kustomization.yaml
configMapGenerator:
  - name: app-config
    literals:
      - LOG_LEVEL=debug
```

When you run:

```bash
kustomize build overlays/dev
```

It will generate a dev-specific `ConfigMap`.

## External Secrets in Production

Use tools like:

* [Bitnami Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets)
* [External Secrets Operator](https://github.com/external-secrets/external-secrets)
* [Vault Agent Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector)

These tools enable safe secret management by avoiding plain-text values in Git and enabling runtime injection.

## Testing ConfigMaps and Secrets

You can dry-run your manifests:

```bash
kustomize build overlays/prod | kubectl apply --dry-run=client -f -
```

Or validate it with:

```bash
kubectl describe configmap <name>
kubectl describe secret <name>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://dinush-chathurya.gitbook.io/kustomize-e-book/kustomize-fundamentals/06-configmap-and-secret-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.