ConfigMaps & Secrets

According to the 12-Factor App methodology, configuration must be separate from code. In Kubernetes, we use ConfigMaps for non-sensitive data (like API URLs) and Secrets for sensitive data (like DB passwords or JWT keys).

1. ConfigMaps

ConfigMaps can be injected into your .NET container as **Environment Variables** or as **Mounted Files**. This allows you to change the "Logging Level" of your app without rebuilding the Docker image.

2. Secrets

Secrets are base64 encoded and stored securely. In a professional environment, you should integrate K8s Secrets with a hardware vault like **Azure Key Vault** or **HashiCorp Vault** for maximum security.

3. Zero-Restart Updates

If you mount a ConfigMap as a file, and you update the ConfigMap in K8s, the file inside your container updates automatically. Your .NET appsettings.json can be configured to "Reload on Change," allowing you to update config without restarting the server!

4. Interview Mastery

Q: "Why is base64 encoding in K8s Secrets NOT considered encryption?"

Architect Answer: "Base64 is just a formatting encoding; anyone can decode it instantly with a simple command. It is provided purely to handle binary data or characters not allowed in YAML. For true security, you must enable **At-Rest Encryption** in your Kubernetes cluster (ETCD encryption) and use strict Role-Based Access Control (RBAC) to limit who can view the secrets."