Config Secrets Volumes

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_MODE: prod
# key APP_MODE

apiVersion: v1
kind: Secret
metadata:
  name: db
type: Opaque
stringData:
  password: s3cret
# stringData auto-encodes

envFrom:
  - configMapRef:
      name: app-config
# APP_MODE=prod in container

volumes:
  - name: cfg
    configMap: { name: app-config }
containers:
  - name: api
    volumeMounts:
      - name: cfg
        mountPath: /config
# /config/APP_MODE file

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 10Gi
# Bound when provisioner succeeds

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db
        key: password
# DB_PASSWORD set

volumeMounts:
  - name: cfg
    mountPath: /app/config.yaml
    subPath: config.yaml
# single file mount

volumes:
  - name: tmp
    emptyDir: {}
# wiped when pod is removed

volumes:
  - name: all
    projected:
      sources:
        - configMap: { name: app-config }
        - secret: { name: db }
# merged mount

configMap:
  name: app-config
  defaultMode: 0440
# mode 440 files

configMapRef:
  name: maybe
  optional: true
# pod starts without it

immutable: true
# cannot update data in place

volumes:
  - name: data
    csi:
      driver: example.csi.k8s.io
      volumeAttributes:
        foo: bar
# provisioned via CSI

volumes:
  - name: docker
    hostPath:
      path: /var/run/docker.sock
# node-specific; security risk

storageClassName: fast-ssd
# selects provisioner parameters