What We’re Building Today
A log-processor FastAPI service that reads its runtime configuration exclusively from a mounted ConfigMap volume, with zero hardcoded values in the image
A Secret-backed database and Kafka credential set, mounted as read-only files instead of environment variables, with RBAC scoping who can read it
A checksum-annotation rolling update mechanism that forces pods to restart automatically whenever the ConfigMap or Secret content changes — no manual
kubectl rollout restartA verification workflow proving zero-downtime config propagation across replicas during a live rolling update
Why This Matters
At companies running hundreds of microservices, configuration drift is a bigger source of incidents than bad code. Baking config into images means every environment change triggers a full rebuild and redeploy pipeline. Using environment variables for secrets means they leak into
kubectl describe podoutput, CI logs, and crash dumps. Netflix and Spotify converged on the same pattern independently: treat configuration as a first-class, versioned Kubernetes object, mount it as a file, and let the kubelet’s projected-volume sync handle propagation. The engineering discipline here isn’t “learn the YAML” — it’s understanding why file-mounted config beats env vars at scale, and why naive ConfigMap updates silently fail to reach running pods.
Kubernetes Architecture Deep Dive
