I'm the author of both of these features. The idea is that you should:
- Use Secrets for things which are actually secret like API keys, credentials, etc
- Use ConfigMaps for not-secret configuration data
In the future, there will likely be some differentiators for secrets like rotation or support for backing the secret API w/ HSMs, etc. In general, we like intent-based APIs, and the intent is definitely different for secret data vs. plain old configs.
Answer from Paul Morie on Stack OverflowI'm the author of both of these features. The idea is that you should:
- Use Secrets for things which are actually secret like API keys, credentials, etc
- Use ConfigMaps for not-secret configuration data
In the future, there will likely be some differentiators for secrets like rotation or support for backing the secret API w/ HSMs, etc. In general, we like intent-based APIs, and the intent is definitely different for secret data vs. plain old configs.
One notable difference in the implementation is that kubectl apply -f:
- ConfigMaps are "unchanged" if the data hasn't changed.
- Secrets are always "configured" - even if the file hasn't changed
After reading a lot of resources about secrets (this https://www.macchaffee.com/blog/2022/k8s-secrets/ included) I really have issue with understanding if there is any difference between secret and configmap object under the hood when it comes to security. If I get this right:
-
If we have TLS enabled between nodes and kubernetes API any request to API is secured thus both configmaps and secrets are transmited in secure way to pods. If no TLS is enabled, they both unsecured in transmission.
-
We can have encryption at rest enabled but according to this guide https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ we can both encrypt configmaps and secrets in ETCD so no difference here.
-
For API access we can enable/dissable access with RBAC both for secrets and configmasp as we like
-
There is suggestion that we can allow certain containers to have access to a certain Secret but I didn't found any method to do so
-
The one difference I found is tmpfs that is used when mounting secret on volume (and thus have 1MB limit)
It seem to me that using secret is just convention and not security manner. If we can use tools like sealed secret we can imagine operators that does same with configmaps (encrypt it to store in git, and decrypt as regular k8s object). If we can use tools like any Vault same way we could protect data in configmap as we do with secret object.
So do I get this right? Is there any real difference apart of convention that secret is the thing we secure more but as soon it gets into the cluster its security is almost same as configmap?
Why use configmaps when we have secrets?
is there a reason to use secrets over configmap on private local cluster?
Kubernetes when to use secrets instead of configmap? - Stack Overflow
Secrets vs Configmaps and its security
Videos
Found a lot of good explanations for why you shouldn't store everything as a Configmap, and why you should move certain sensitive key-values over to a Secret instead. Makes sense to me.
But what about taking that to its logical extreme? Seems like there's nothing stopping you from just feeding in everything as secrets, and abandoning configmaps altogether. Wouldn't that be even better? Are there any specific reasons not to do that?
running a local selfhosted k8s cluster and i need to store "Credentials" for pods (think user name / pw for mealie db..so nothing critical)
I am the only person that has access to the cluster.
Given these constraints, is there a reason to use secrets over configmaps?
Like, both secrets and configmaps can be read easily if someone does get into my system.
my understanding with secrets and configmaps is that if i was giving access to others to my cluster, i can use RBAC to control who can see secrets and what not.
am i missing something here?
Secrets are stored encoded and over time will become more protected (e.g. limited access, encrypted at rest, etc). Secrets existed before ConfigMap was created, so until recently it was common to store configuration data in secrets (e.g. conf2kube).
You should use secrets for sensitive data (database passwords, private keys) and ConfigMaps for non-sensitive configuration data.
Most importantly secrets are stored in tmpfs, an in memory file system, and are never persisted to a node file system.
Conversely they consume RAM.