What is the difference between secrets and configmaps in Kubernetes?

Secrets are used to store sensitive information such as passwords, API keys, and certificates. They are encoded in base64 by default (although this is not data encryption at rest, just encoding) and are handled by Kubernetes with a higher level of security (for example, they are not displayed directly in logs when viewed).

ConfigMaps are used to store non-sensitive application configuration information, such as service URLs, logging settings, and configuration files. They are stored as key-value pairs or as entire files. ConfigMaps do not provide any additional data protection.

Parameter	Secrets	ConfigMaps
Purpose	Storage of sensitive information	Storage of non-sensitive configuration
Encoding	base64 (by default)	None
Security	Enhanced (not displayed in logs, etc.)	No specific security measures
Data examples	Passwords, tokens, keys, certificates	Environment variables, configuration files

Both objects can be mounted into pods as files or environment variables.

# Example of mounting a secret as an environment variable
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: my-image
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: my-db-secret
          key: password

# Example of mounting a ConfigMap as a file
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: my-image
    volumeMounts:
    - name: config-volume
      mountPath: /etc/config
  volumes:
  - name: config-volume
    configMap:
      name: my-app-config