The Twelve-Factor App methodology mandates strict separation of application code from configuration settings. ConfigMaps store non-sensitive configuration data (URLs, log levels), while Secrets store sensitive values (passwords, API tokens, TLS keys).
GitOps has one fatal flaw: You cannot commit secrets to a Git repository. When Kratix generates a Redis password during a Pipeline execution, how does it securely deliver that password to the Worker Cluster? In this episode, we solve the GitOps secrets problem using HashiCorp Vault and ESO.
Crossplane is useless on its own. To orchestrate AWS, Azure, or GCP, we must install Providers. In this episode, we install the official Upbound AWS Provider, configure Kubernetes Secrets to store our IAM credentials, and bind them to a ProviderConfig.
Hardcoding values like instance sizes and database passwords into your TypeScript code is a severe anti-pattern. In this episode, we learn how to decouple configuration from code using the Pulumi Config system, allowing the exact same codebase to deploy vastly different Staging and Production architectures.
Decoupling application code from environment configuration and enforcing security policies is tested extensively on the CKAD exam. You must know how to pass ConfigMaps and Secrets into Pods as environment variables or volume mounts.
