Externalize Configuration

Use your browser to download either ivia-chapter-06.tar.gz or ivia-chapter-06.zip. The archive is self-contained; you do not need this tutorial repository.

cd ~/Downloads
tar -xzf ivia-chapter-06.tar.gz
cd ivia-chapter-06

Set-Location "$HOME\Downloads"
Expand-Archive -Path ivia-chapter-06.zip -DestinationPath . -Force
Set-Location ivia-chapter-06

All remaining relative paths in this chapter start from that extracted directory.

| Mechanism | Use for | Not for | | --- | --- | --- | | Hard-coded in image | Truly fixed assets | Environment banners, URLs, credentials | | ConfigMap | Non-sensitive settings and files | Passwords, API keys, tokens | | Secret | Credentials and tokens (still protect access) | Believing data is encrypted at rest by default |

Trade-off: environment variables are simple for short values; mounted files suit multi-line content and avoid leaking values into process listings as easily. Secrets in Kubernetes are base64-encoded in the API and etcd by default—that is not encryption. Restrict RBAC, prefer external secret managers in production, and never commit real credentials.

Build the packaged source into Minikube and prepare the chart's scheduling label:

minikube image build -t simple-static:local static-app
kubectl label node minikube ivia.ch/nodetype=app --overwrite
kubectl create namespace tutorial \
  --dry-run=client -o yaml \
  | kubectl apply -f -

We write a temporary values file so the chapter stays self-contained and you can edit one place.

mkdir -p work
cat > work/simple-app-config.yaml <<'EOF'
components:
  frontend:
    enabled: true
    name: frontend
    image: {repository: simple-static, tag: local, pullPolicy: IfNotPresent}
    port: 8080
    health: /healthz
    readinessProbe: |
      httpGet:
        path: {{ .Component.health }}
        port: {{ include "ivia.firstPort" . }}
      periodSeconds: 5
    livenessProbe: |
      httpGet:
        path: {{ .Component.health }}
        port: {{ include "ivia.firstPort" . }}
      periodSeconds: 10
    configMaps:
      - name: page
        data:
          environment.txt: "Hello from Minikube configuration!"
    configMapVolumes:
      - name: page-config
        configMapName: '{{ include "ivia.componentName" . }}-page'
        mountPath: /usr/share/nginx/html/environment.txt
        subPath: environment.txt
        readOnly: true
    secrets:
      - name: demo
        stringData:
          DEMO_TOKEN: "not-a-real-secret-replace-me"
    extraEnv: |
      - name: DEMO_TOKEN
        valueFrom:
          secretKeyRef:
            name: "{{ .Release.Name }}-demo"
            key: DEMO_TOKEN
    ingress:
      enabled: false
  backend:
    enabled: false
EOF

Render and inspect before applying:

helm template simple-app \
  oci://harbor.ivia.ch/ivia-generic-helm-chart/ivia-generic-helm-chart \
  --version 4.8.0 -n tutorial -f work/simple-app-config.yaml \
  | grep -E 'kind: ConfigMap|kind: Secret|mountPath:|environment.txt|DEMO_TOKEN'

You should see both a ConfigMap and a Secret object in the rendered output, plus the mount and env references. Chart-managed Secrets are named {{ .Release.Name }}-<name> (here simple-app-demo).

helm upgrade --install simple-app \
  oci://harbor.ivia.ch/ivia-generic-helm-chart/ivia-generic-helm-chart \
  --version 4.8.0 -n tutorial --atomic --timeout 5m \
  -f work/simple-app-config.yaml
kubectl rollout status deployment/simple-app-frontend -n tutorial --timeout=120s
kubectl port-forward service/simple-app-frontend 8080:8080 -n tutorial

In a second terminal:

curl --fail http://localhost:8080/environment.txt
kubectl get configmap simple-app-frontend-page -n tutorial -o yaml
kubectl get secret simple-app-demo -n tutorial -o jsonpath='{.data.DEMO_TOKEN}' | base64 --decode; echo
kubectl exec deploy/simple-app-frontend -n tutorial -- printenv DEMO_TOKEN

You should see the banner text, a ConfigMap containing that text, and the decoded / in-pod Secret value not-a-real-secret-replace-me.

Change only the ConfigMap text in the temporary values file, repeat helm upgrade, and curl again. A fresh Pod mounts the current ConfigMap. Use extraEnv for scalar process settings, mounted ConfigMaps for files, and Secrets or an external secret manager for credentials.