Kubernetes: where does each config variable actually live?
Deploying on Kubernetes forced me to clarify a simple question: where does each config variable live? 🔑
My mental grid, applied to this website (Symfony + Next.js on k8s):
- 🔹 k8s Secret: anything sensitive and read at runtime. SMTP credentials, secret API keys… The pod receives them as environment variables — nothing in the image, nothing in the repo.
- 🔹 ConfigMap: non-sensitive config that varies per environment.
- 🔹 Docker build-arg: what must be frozen into the artifact at build time — typically the
NEXT_PUBLIC_*variables of a Next.js frontend, compiled into the JS bundle.
The question to ask for every variable: "Who consumes it, and when?" The server at runtime → Secret/ConfigMap. The client's browser → it must be there at build time.
Picking the wrong box means either a secret key exposed in a public bundle, or a frontend pointing at localhost in production. Both cost you dearly. 😬
