Namespaces, ConfigMaps, Secrets, resources and probes

Namespaces

A namespace is a named section of a cluster. Object names must be unique inside a namespace, but two namespaces can each have a Service called api. Teams use namespaces to separate apps or environments, and to set permissions (RBAC) and quotas per namespace. A new cluster has default, kube-system (the cluster's own components) and a few others.

kubectl create namespace payments
kubectl get pods -n payments
kubectl config set-context --current --namespace=payments   # make it your default

ConfigMaps: settings outside the image

You build one image and run it in dev, staging and production. What changes is configuration: the log level, a feature switch, another service's URL. A ConfigMap stores such non-secret settings as key-value pairs, and pods read them as environment variables or as files.

apiVersion: v1
kind: ConfigMap
metadata:
  name: payments-config
data:
  LOG_LEVEL: info
  BANK_API_URL: https://bank-sandbox.example.com
  limits.json: |
    {"dailyLimitRupees": 100000}
---
# in the Deployment's pod template:
spec:
  containers:
    - name: api
      image: registry.example.com/payments-api:1.4.2
      envFrom:
        - configMapRef:
            name: payments-config        # every key becomes an env variable
      volumeMounts:
        - name: config
          mountPath: /etc/payments       # limits.json appears as a file here
  volumes:
    - name: config
      configMap:
        name: payments-config

Environment variables are read once when the container starts, so after changing a ConfigMap you must restart the pods: kubectl rollout restart deployment/payments-api. Mounted files are updated after a short delay, but only if your app re-reads them.

Secrets: base64 is not encryption

A Secret looks like a ConfigMap but is meant for passwords, tokens and keys. Its data values are base64-encoded. Base64 is an encoding, a way to write any bytes as plain letters; it is not encryption. Anyone who can read the Secret can decode it in one command.

echo -n 'S3cure#Pass' | base64          # UzNjdXJlI1Bhc3M=
kubectl create secret generic db-credentials --from-literal=password='S3cure#Pass'
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d

So protect Secrets properly:

• RBAC (role-based access control): allow get and list on Secrets only to the people and service accounts that need them.
• Encryption at rest: configure the API server (or turn on the option in your managed cluster) so Secrets are encrypted in etcd, ideally with a cloud KMS key.
• External secret managers: keep the real values in AWS Secrets Manager, Azure Key Vault, Google Secret Manager or HashiCorp Vault, and sync them into the cluster with a tool such as the External Secrets Operator or the Secrets Store CSI driver.
• Never commit a plain Secret YAML to Git. If you must keep it in Git, encrypt it first with a tool such as Sealed Secrets or SOPS.

Requests and limits

A request is what the scheduler reserves for a container: it only places the pod on a node with that much free. A limit is the most the container may use. CPU is measured in cores: 1 means one full vCPU and 250m (250 millicores) means a quarter of one. Memory is measured in bytes with suffixes: Mi is a mebibyte (1,048,576 bytes) and Gi a gibibyte; M and G are the decimal versions (1,000,000 and 1,000,000,000).

Going over the CPU limit only slows the container down (throttling). Going over the memory limit gets the container killed, and kubectl describe shows the reason OOMKilled (out of memory), usually with exit code 137. Kubernetes then restarts it, and if it keeps happening you see CrashLoopBackOff.

Probes: alive, ready, started

containers:
  - name: api
    image: registry.example.com/payments-api:1.4.2
    resources:
      requests:
        cpu: 250m
        memory: 256Mi
      limits:
        memory: 512Mi
    env:
      - name: DB_PASSWORD
        valueFrom:
          secretKeyRef:
            name: db-credentials
            key: password
    startupProbe:
      httpGet: { path: /healthz, port: 8080 }
      failureThreshold: 30
      periodSeconds: 2          # allow up to 60 seconds to start
    livenessProbe:
      httpGet: { path: /healthz, port: 8080 }
      periodSeconds: 10
    readinessProbe:
      httpGet: { path: /ready, port: 8080 }
      periodSeconds: 5