Configuration & Secrets

The cost of configuration drift

Most cluster incidents are configuration incidents. They present as crashes, routing failures, or partial unavailability—but the root is a missing key, a wrong name, or an implicit default.

The discipline is to make configuration explicit, versioned, validated, and observable.

• Prefer explicit keys over implicit env inheritance where you need stability.
• Treat secrets as hazardous material: minimize distribution and exposure.
• Make config changes reversible; roll them as you roll code.

Proof ritual

Before you restart workloads, prove the references are correct.

kubectl get configmap,secret -n <ns>
kubectl get pod <pod> -n <ns> -o yaml | rg -n "envFrom:|configMapKeyRef|secretKeyRef|volumes:|volumeMounts:"