Where should a database password go in Kubernetes?
Options
- Inside the container image, so that it is always available
- In a ConfigMap, next to the other settings of the app
- In a Secret, ideally from an external manager, as env var or file (Correct option)
- Hardcoded in the Deployment YAML, which is kept in git
Answer
In a Secret (ideally backed by an external secret manager), injected as env var or file
Why
ConfigMaps are for normal settings; Secrets are for sensitive values, injected into Pods as environment variables or files.
Note: Kubernetes Secrets are only base64-encoded by default (not encrypted), so enable encryption at rest and restrict who can read them, or sync them from a real secret manager (Vault, AWS Secrets Manager).
Never put passwords in the image or in YAML committed to git.
Remember
Passwords → Secret, not ConfigMap, never in git.