<p>Have been using Kubernetes secrets up to date.
Now we have ConfigMaps as well.</p>

<p>What is the preferred way forward - secrets or config maps?</p>

<p>P.S. After a few iterations we have stabilised at the following rule:</p>

<ul>
<li><p>configMaps are per solution domain (can be shared across microservices within the domain, but ultimately are single purpose config entries)</p></li>
<li><p>secrets are shared across solution domains, usually represent third party systems or databases</p></li>
</ul>

<p>I'm the author of both of these features. The idea is that you should:</p>
<ol>
<li>Use <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secrets</a> for things which are actually secret like API keys, credentials, etc</li>
<li>Use <a href="https://kubernetes.io/docs/concepts/configuration/configmap/" rel="nofollow noreferrer">ConfigMaps</a> for not-secret configuration data</li>
</ol>
<p>In the future, there will likely be some differentiators for secrets like rotation or support for backing the secret API w/ HSMs, etc.  In general, we like intent-based APIs, and the intent is definitely different for secret data vs. plain old configs.</p>
