All 15 Docker & Deployment questions
More in Docker & Deployment
What is the difference between the CMD and ENTRYPOINT instructions in a Dockerfile for a Node.js application? How does Docker Compose simplify local development for a Node.js application that depends on a database and a cache? What is a .env file, and how does it interact with a Dockerized Node.js application's configuration? What is the purpose of a HEALTHCHECK instruction in a Dockerfile for a Node.js application? What is the purpose of setting explicit CPU and memory resource requests and limits for a Node.js container in Kubernetes? How do you properly handle process signals (SIGTERM) inside a containerized Node.js application to support graceful shutdown? Why should a Node.js Docker container generally run as a non-root user, and how do you configure this in a Dockerfile? How would you optimize Docker layer caching in a Node.js Dockerfile to speed up repeated builds during development? What is the difference between deploying a Node.js application to a Platform-as-a-Service (like Heroku or Render) versus a self-managed container orchestrator (like Kubernetes)? What is a Kubernetes Deployment's rolling update strategy, and how does it apply to updating a running Node.js application?
Advertisement
Node.js › Docker & Deployment

How do Kubernetes ConfigMaps and Secrets differ, and how are they typically consumed by a Node.js pod?

Intermediate

Answer

A ConfigMap stores non-sensitive configuration data (feature flags, non-secret URLs) as key-value pairs that can be injected into a pod as environment variables or mounted files. A Secret stores similar key-value data but intended for sensitive values (passwords, API keys), base64-encoded (not encrypted by default, though can be encrypted at rest with additional configuration) and with tighter default access controls -- both are typically consumed by a Node.js application identically, simply as environment variables, regardless of which Kubernetes object supplied them.
# Deployment spec referencing both
env:
  - name: FEATURE_FLAG
    valueFrom: { configMapKeyRef: { name: app-config, key: featureFlag } }
  - name: DATABASE_PASSWORD
    valueFrom: { secretKeyRef: { name: app-secrets, key: dbPassword } }
Real-world example A Node.js deployment loads its non-sensitive log level and feature flags from a ConfigMap while loading its database password and API keys from a Secret, both surfaced identically to the application as regular environment variables, keeping the Node.js code itself agnostic to which mechanism supplied each value.

Common follow-ups: Why is Kubernetes Secret's default base64 encoding not the same thing as actual encryption?;How would you configure encryption at rest for Kubernetes Secrets in a production cluster?

Environment Variables & Configuration;Security
All 15 Docker & Deployment questions