k8s-storage
Installation
SKILL.md
k8s-storage
Patterns and decisions for ConfigMaps, Secrets, and persistent storage in self-hosted Kubernetes clusters.
ConfigMap vs Secret
| Situation | Use |
|---|---|
| Non-sensitive config (ports, feature flags, proxy settings) | ConfigMap |
| Anything sensitive (passwords, API keys, tokens, TLS certs, DB connection strings) | Secret |
| Binary data (font files, BSON files, compiled templates) | ConfigMap binaryData or Secret (auto-base64) |
| Shared config file content (nginx.conf, app.yaml) | ConfigMap data with multiline | block |
Rule: When in doubt, use a Secret. Secrets can be encrypted at rest; ConfigMaps cannot. The only cost is base64 encoding, which is trivial.