⎈Deploying a Flask Application using ConfigMaps and Secrets in Kubernetes⎈

>>> A Hands-On Guide to Managing Application Configuration and Sensitive Data using ConfigMaps, Secrets, Deployments, and NodePort Services

Deploying a Flask Application using ConfigMaps and Secrets in Kubernetes by Sai Manasa

Hello World… Welcome back to the next hands-on Kubernetes project. In this project, we’ll look at how configuration is managed in Kubernetes using ConfigMaps and Secrets. In real-world applications, it’s not a good practice to keep configuration values or sensitive information like database credentials directly inside the application code. Instead, Kubernetes allows us to store and manage these values separately using dedicated resources. To see how this works in practice, we’ll deploy a simple Flask API, configure the application via a ConfigMap, and store sensitive data, such as database credentials, in a Secret. This approach keeps the application code clean while making deployments more flexible and secure. Let’s go… 🚀

Overview:

• What is ConfigMap?
• What is Secret?
• Simple hands-on guide
• Architecture Diagram

What is ConfigMap?

• A ConfigMap is a Kubernetes resource used to store non-sensitive configuration data as key–value pairs.
• It allows you to keep application configuration separate from the container image so that the same application can run in different environments without modifying the code.
• Instead of hardcoding values such as environment names, feature flags, or application settings within the application, store them in a ConfigMap and inject them into Pods as environment variables or mount them as configuration files.

What is Secret?

• A Secret is a Kubernetes resource designed to store and manage sensitive information such as passwords, API keys, tokens, or database credentials.
• While the data is stored in an encoded format (base64) in Kubernetes, it helps prevent sensitive information from being exposed directly in configuration files or container images.
• Similar to ConfigMaps, Secrets can be injected into Pods as environment variables or mounted as files, allowing applications to securely access the data they need at runtime.

Simple Hands-On Guide:

Task Overview: Deploy a simple Flask API in Kubernetes to understand how application configuration can be managed using ConfigMaps and Secrets. Create a ConfigMap to store non-sensitive configuration values such as the application environment and color settings, and create a Secret to securely store sensitive information like database credentials. Deploy the Flask application using a Deployment and inject both the ConfigMap and Secret into the container as environment variables. Expose the application using a NodePort Service to access it from outside the cluster and verify that the application is correctly reading the configuration values provided by Kubernetes.

Step 1: Create a Simple Flask Application

• To demonstrate how Kubernetes manages configuration using ConfigMaps and Secrets, we first need a simple application that can read configuration values from environment variables.
• In this project, we’ll use a lightweight Flask API that returns a few configuration values when accessed through a browser.
• The application will read four environment variables: APP_ENV – represents the application environment (for example: dev or prod) APP_COLOR – a sample configuration value used to demonstrate non-sensitive settings DB_USER – database username (stored in a Secret) DB_PASSWORD – database password (stored in a Secret)
• In the next steps, these values will not be hardcoded. Instead, Kubernetes will inject them into the container using ConfigMaps and Secrets.
• Create a file named app.py and add the following code:

[embed]

• This simple API reads environment variables using Python’s os.getenv() function and returns them as a JSON response.
• Once deployed in Kubernetes, these values will be automatically populated using the ConfigMap and Secret resources we create later in the guide.

Step 2: Containerize the Flask Application

• Now that we have a simple Flask application, the next step is to package it into a Docker container image so that it can run inside Kubernetes.
• Containerizing the application ensures that all required dependencies are included and the application runs consistently across different environments.
• First, create a file named requirements.txt to define the Python dependencies required for the application:

flask

• Next, create a Dockerfile to build the container image for the Flask application.

[embed]

• This Dockerfile performs the following steps: Uses a lightweight Python Alpine base image Sets the working directory inside the container Installs the Flask dependency Copies the application code into the container Exposes port 5000 for the Flask application Starts the application when the container runs
• After creating the Dockerfile, build the Docker image and push it to your Docker Hub repository so Kubernetes can pull it during deployment.

# command to build the docker image
# Syntax: docker build -t <dockerhub-username>/<image-name>:<tag> <Dockerfile-Path>>
docker build -t saimanasak/flask-k8s-cm-secrets-demo:v1 .

• Verify the images after building is done:

# command to list the docker images present
docker images

• If Docker Desktop is present, you can directly push the image to Docker Hub.
• If not, use the below command to log in to Docker Hub:

# command to login
docker login

• Now, push the Docker image built above to the Images Repo, like Docker Hub:

# command to push the docker image
# Syntax: docker push <dockerhub-username>/<image-name>:<tag>
docker push saimanasak/flask-k8s-cm-secrets-demo:v1

• Once the image is available in Docker Hub, we can use it in our Kubernetes deployment.

Step 3: Create a ConfigMap

• Now that the application image is ready, the next step is to store the application’s configuration using a ConfigMap.
• ConfigMaps are used to store non-sensitive configuration values that an application might need at runtime.
• Here, we’ll store two configuration values: APP_ENV – defines the environment in which the application is running (for example: dev or prod) APP_COLOR – a sample configuration value used to demonstrate how application settings can be managed externally
• Instead of hardcoding these values inside the application, we’ll store them in a ConfigMap and later inject them into the container.
• Create a file named configmap.yaml inside your Kubernetes manifests directory and add the following configuration:

[embed]

• Now, apply the configmap:

# command to apply the config map or any K8s manifest file
# Syntax: kubectl apply -f <file-name>
kubectl apply -f configmap.yaml

• Verify the configmap created:

# command to list the configmaps present
kubectl get configmap
kubectl get cm

• Describe the configmap:

# command to describe a particular configmap
# Syntax: kubectl describe cm <cm-name>
kubectl describe cm my-flask-config
kubectl describe configmap my-flask-config

• This ConfigMap now stores the application configuration, which will later be injected into the Flask container as environment variables during deployment.

Step 4: Create Secret

• Create a Secret to store sensitive information for the application.
• Unlike ConfigMaps, which are used for non-sensitive configuration, Secrets are designed to hold confidential data such as passwords, API keys, or tokens.
• Here, we’ll store the following database credentials: DB_USER – database username DB_PASSWORD – database password
• Kubernetes Secrets store values in base64 encoded format, so we first need to encode the values before adding them to the manifest.
• Generate the base64 values using the following commands:

echo -n "root" | base64 
echo -n "mypassword" | base64

• Now, create a file named secret.yaml:

[embed]

• Apply the secret:

# command to apply the secret or any K8s manifest file
# Syntax: kubectl apply -f <file-name>
kubectl apply -f secret.yaml

• Verify the secrets created:

# command to list the secrets present
kubectl get secrets

• Describe the secret:

# command to describe a particular secret
# Syntax: kubectl describe secret <secret-name>
kubectl describe secret my-flask-secret

Step 5: Deploy the Flask Application

• Create a Deployment that runs multiple replicas of the Flask application and pulls the container image from Docker Hub.
• The Deployment will reference both the ConfigMap and Secret, allowing Kubernetes to automatically inject the configuration values and credentials as environment variables inside the container.
• Create a file named deployment.yaml -

[embed]

• Apply the deployment file configuration:

# To create the deployment:
kubectl apply -f <deploy-file-name>

• Verify the resources created from the deployment:

# To get deployments in a particular namespace
kubectl get deploy -n <namespace-name>
kubectl get deployments -n <namespace-name>

# To get deployments in the default namespace
kubectl get deploy
kubectl get deployments

# To get ReplicaSets in a particular namespace
kubectl get rs -n <namespace-name>
kubectl get replicaset -n <namespace-name>
kubectl get replicasets -n <namespace-name>

# To get ReplicaSets in the default namespace
kubectl get rs
kubectl get replicaset
kubectl get replicasets

# To get Pods in a particular namespace
kubectl get po -n <namespace-name>
kubectl get pods -n <namespace-name>

# To get Pods in the default namespace
kubectl get po
kubectl get pods

# To list all resources in a specific namespace
kubectl get all -n <namespace-name>

# To list all resources in the default namespace
kubectl get all

• Here, K8s will create the Flask application pods, pull the container image from Docker Hub, and inject the values from the ConfigMap and Secret as environment variables inside the container.

Step 6: Expose the App Using NodePort Service

• A NodePort Service opens a specific port on each node in the cluster and forwards incoming traffic to the application pods.
• This allows us to access the application using the node’s IP address and the assigned NodePort.
• Create a file named service.yaml -

[embed]

• Commands:

# To create/apply the changes in the service:
kubectl apply -f <service-file-name>

# To list the services in a namespace:
kubectl get svc -n <namespace>

# To list all the services:
kubectl get svc - A

# To list the endpoints:
kubectl get endpoints -n <namespace-name>

# To delete a service:
kubectl delete svc <service-name> -n <namespace>

• To access the application using minikube, please go through Steps 8 and 9 of the blog below:

[embed]⎈Helm Deployment of an Nginx Application Using a NodePort Service in Kubernetes⎈ >>> A hands-on guide to deploying Nginx with Helm, exposing it externally using NodePort, and understanding Kubernetes…saimanasak.medium.com

• Output:

• Also, verify the environment variables of the created ConfigMap and Secrets using -

kubectl exec -it <pod-name> -- env

• It’s done… 🙌

Architecture Diagram:

Deploying a Flask Application using ConfigMaps and Secrets by Sai Manasa

Repos:

The repositories:

• Deploying a Flask Application using ConfigMaps and Secrets
• Kubernetes

Let’s Connect:

Feel free to get in touch, share your ideas or feedback, or ask any questions. I’m excited to engage with you and learn from each other as we navigate this exciting field!

LinkedIn: Sai Manasa

GitHub: Sai Manasa

[embed]saimanasak - Overview DevOps Engineer | Bibliophile . saimanasak has 24 repositories available. Follow their code on GitHub.github.com

Happy Deploying 😄