Yaya ConfigMaps da Secrets ke aiki don sanya saiti cikin workload?

Question

IT Interview Practice · Accepted Answer

**ConfigMaps** da **Secrets** suna raba saiti daga container images, don haka image ɗaya ya gudana a dev, staging, da production da saituna daban-daban. ConfigMaps suna riƙe saiti **marar tsananin sirri**; Secrets suna riƙe bayanai **masu tsananin sirri** (kalmomin sirri, tokens, keys) kuma ana kula da su a hankali sosai.

## Ra'ayin: saiti a waje da image

```text
Image = code (mai canzawa, an gina sau ɗaya).  Config = ƙima ga kowane muhalli.
Toya saiti cikin image tsari ne mara kyau (sake gina kowane muhalli, secrets suna zubewa).
→ Ajiye saiti a ConfigMaps/Secrets, sanya lokacin gudanarwa a matsayin env vars ko fayiloli.
```

## ConfigMap: saitunan marasa tsananin sirri

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  LOG_LEVEL: "info"
  FEATURE_X: "true"
  app.properties: |
    timeout=30
    retries=3
```

## Secret: ƙima masu tsananin sirri

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
stringData:            # rubutu bayyananne a nan; ana ajiye base64-encoded a etcd
  DB_PASSWORD: "s3cr3t"
  DB_USER: "appuser"
```

```bash
# Galibi ana ƙirƙira ta hanyar umarni don guje wa aikata secrets zuwa git:
kubectl create secret generic db-secret \
  --from-literal=DB_USER=appuser --from-literal=DB_PASSWORD=s3cr3t
```

## Sanyawa cikin Pod: a matsayin env vars ko a matsayin fayiloli

```yaml
spec:
  containers:
    - name: app
      image: myapp:1.0
      env:
        - name: LOG_LEVEL                 # maɓalli guda daga ConfigMap
          valueFrom:
            configMapKeyRef: { name: app-config, key: LOG_LEVEL }
        - name: DB_PASSWORD               # maɓalli guda daga Secret
          valueFrom:
            secretKeyRef: { name: db-secret, key: DB_PASSWORD }
      envFrom:
        - configMapRef: { name: app-config }   # shigo da DUK maɓallai a matsayin env vars
      volumeMounts:
        - name: config-vol
          mountPath: /etc/config           # ɗora saiti a matsayin fayiloli
  volumes:
    - name: config-vol
      configMap: { name: app-config }
```

## Muhimman gargaɗi game da Secrets

```text
⚠ Bayanan Secret suna base64-ENCODED, ba a ɓoye ba, ta tsoho.
  → Kunna ENCRYPTION AT REST don etcd (EncryptionConfiguration).
  → Ƙuntata damar shiga da RBAC (wa zai iya 'get secrets').
  → Fifita managers na waje (Vault, cloud Secrets Manager) ko sealed secrets.
  → Kada ka taɓa aikata ainihin Secret manifests zuwa git.
Saitin env-var ana karanta shi SAU ƊAYA lokacin farawar container; fayilolin da aka ɗora za su iya sabuntawa a raye.
```

## Me ya sa yake da muhimmanci

Raba saiti daga code muhimmin aiki ne na gudanarwa, kuma ConfigMaps da Secrets su ne yadda Kubernetes ke aiwatar da shi, don haka fahimtar su ilimi ne mai mahimmanci na tsaka-tsaki. Toya saitunan da suka danganci muhalli cikin image tsari ne mara kyau — yana tilasta sake gina kowane muhalli kuma yana da haɗarin zubar da secrets — don haka Kubernetes yana bari ka riƙe image ɗaya wanda ba ya canzawa ka kuma sanya saiti lokacin gudanarwa: **ConfigMaps** don ƙima marasa tsananin sirri (log levels, feature flags, config files) da **Secrets** don bayanai masu tsananin sirri (kalmomin sirri, tokens, keys). Sanin hanyoyi biyu na cinye su — a matsayin **environment variables** (maɓallai daban-daban ta `configMapKeyRef`/`secretKeyRef`, ko duk maɓallai ta `envFrom`) da a matsayin **fayiloli da aka ɗora** (da bambancin cewa env vars ana karanta su sau ɗaya lokacin farawa yayin da fayilolin da aka ɗora za su iya sabuntawa a raye) — ilimi ne mai amfani na yau da kullum don tura ainihin aikace-aikace. Daidai da muhimmanci shine fahimtar gargaɗin tsaro da ke tafka wa injiniyoyi da yawa: bayanan Secret suna **base64-encoded kawai, ba a ɓoye ba**, ta tsoho, don haka kariyar su ta gaske tana buƙatar kunna **encryption at rest** don etcd, ƙuntata damar shiga da **RBAC**, guje wa aikata Secret manifests zuwa version control, kuma sau da yawa haɗa manajan secret na waje. Saboda kusan kowane workload yana buƙatar saiti da takaddun shaida na kowane muhalli, kuma saboda kula da Secrets ba daidai ba giɓin tsaro ne na yawaita da tsanani, fahimtar ConfigMaps da Secrets sosai na tushe ne don gudanar da aikace-aikace cikin aminci da daidai a kan Kubernetes.

Ra'ayin: saiti a waje da image

ConfigMap: saitunan marasa tsananin sirri

Secret: ƙima masu tsananin sirri

Sanyawa cikin Pod: a matsayin env vars ko a matsayin fayiloli

Muhimman gargaɗi game da Secrets

Me ya sa yake da muhimmanci

Tambayoyi masu alaƙa