In Kubernetes, what is the difference between a ConfigMap and a Secret?
Options
- There is no difference between them, apart from the name
- ConfigMap holds plain config; Secret holds sensitive values (base64) (Correct option)
- ConfigMap stores container images; Secret stores the pod logs
- A Secret is read faster, because it is always kept in memory
Answer
ConfigMap holds non-sensitive configuration; Secret holds sensitive values (passwords, tokens) with extra handling, but is only base64-encoded unless encryption at rest is enabled
Why
Both inject settings into Pods as environment variables or mounted files, so you do not bake them into the image.
- ConfigMap: plain settings (URLs, feature switches, log level).
- Secret: passwords, API keys, certificates. Access can be restricted with RBAC.
Important: Secrets are only base64-encoded by default, which is not encryption. Enable encryption at rest or use an external manager (AWS Secrets Manager, Azure Key Vault) with a CSI driver or External Secrets.
Remember
ConfigMap = config. Secret = sensitive config (still protect it).