ConfigMap & Secret

# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: "info"
  config.yaml: |
    server:
      port: 8080
      timeout: 30s

---
# secret.yaml (values must be base64-encoded)
apiVersion: v1
kind: Secret
metadata:
  name: api-secret
type: Opaque
data:
  DB_PASSWORD: c2VjcmV0   # echo -n secret | base64

---
# Pod consuming them
spec:
  containers:
    - name: api
      envFrom:
        - configMapRef: { name: api-config }
        - secretRef:    { name: api-secret }
      volumeMounts:
        - name: cfg
          mountPath: /etc/app