Home
K8S Configmap Secret Generator

Kubernetes ConfigMap & Secret YAML Generator

Generate production-ready Kubernetes ConfigMap and Secret (Opaque, TLS, docker-registry) YAML manifests with base64 encoding and immutability.

Presets:
Configuration & Payloads
Kubernetes Resource Metadata
Payload Data Items (5)
#1
#2
#3
#4
#5
Labels & Annotations
Labels (3)
Annotations (2)
Kind: ConfigMapEntries: 5
Payload: 1.5 KB(0.15% etcd)
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-runtime-config
  namespace: production
  labels:
    app.kubernetes.io/name: "api-service"
    app.kubernetes.io/env: "production"
    app.kubernetes.io/managed-by: "gitops"
  annotations:
    reloader.stakater.com/auto: "true"
    description: "Primary web service application parameters"
immutable: true
data:
  APP_ENV: production
  LOG_LEVEL: info
  CACHE_TTL_SECONDS: "3600"
  FEATURE_ASYNC_ORDERS: "true"
  config.json: |
    {
      "rateLimit": {
        "requestsPerMinute": 1200,
        "burst": 50
      },
      "metrics": {
        "prometheusEnabled": true,
        "path": "/metrics",
        "port": 9090
      },
      "circuitBreaker": {
        "failureThreshold": 5,
        "resetTimeoutMs": 15000
      }
    }
Lines: 34Size: 786 B
API: v1 / ConfigMapImmutable: true
Payload Entries
5 Keys
etcd Memory Budget
1.5 KB / 1 MB
Security Compliance
Grade A+ (100%)

100% In-Browser Cryptography

Base64 encoding and secret parsing run entirely in your local browser sandbox with zero external transmissions.

Cloud-Native Spec Validation

Ensures compliance with RFC 1123 DNS subdomain keys, TLS certificate standards, and etcd 1MB limits.

Full Workload Integration

Instantly exports manifests alongside Pod volumeMounts, envFrom references, Kustomize generators, and CLI commands.

Technical Reference & Architecture Guide

K8S Configmap Secret Generator — Reference Guide

Developer utility for generating Kubernetes ConfigMap and Secret manifests with base64 data encoding, stringData, TLS, Docker registry auth, and immutable resource flags.

Key Parameters & Controls

kind'ConfigMap' | 'Secret'

Specifies the target Kubernetes resource API schema to construct.

Default: 'ConfigMap'
secretEncoding'data' | 'stringData'

Selects pre-encoded base64 payload format ('data') or plain text input ('stringData') for Secret resources.

Default: 'data'
secretType'Opaque' | 'kubernetes.io/tls' | 'kubernetes.io/dockerconfigjson' | 'kubernetes.io/basic-auth' | 'kubernetes.io/ssh-auth'

Defines the Kubernetes Secret classification schema and enforces required payload keys.

Default: 'Opaque'
immutableboolean

Sets the metadata immutable flag (Kubernetes 1.19+) to prevent cluster-side mutations and reduce kube-apiserver watch load.

Default: false
entriesKeyValEntry[]

Collection of key-value definitions containing identifier strings, content values, and multiline or binary format flags.

Default: []

Pro Tips & Best Practices

Leverage Immutable Flag

Setting `immutable: true` on ConfigMaps and Secrets prevents accidental configuration drift and drastically reduces kube-apiserver watch overhead in clusters running thousands of pods.

Prefer stringData for GitOps

Use `stringData` when authoring manifests in GitOps pipelines managed by SOPS, Sealed Secrets, or Kustomize; the kube-apiserver automatically converts values into base64 upon admission.

Handle TLS Bundle Cleanly

For `kubernetes.io/tls` secrets, concatenate the server certificate and intermediate CA chain into `tls.crt` with standard Unix LF line endings to avoid x509 handshake failures in ingress controllers.

Common Gotchas & Troubleshooting

Base64 Padding and Newline Corruption in Pods

Strip trailing Windows carriage returns (`\r\n`) before generating base64 payloads. Unchecked CR characters within encoded strings trigger silent parsing errors inside Linux containers.

RFC 1123 DNS Subdomain Rejection on Apply

Ensure resource names contain only lowercase alphanumeric characters, '-', or '.', and begin and end with an alphanumeric character. Uppercase characters and underscores violate the Kubernetes API DNS subdomain schema.

Frequently Asked Questions

How do base64 data and plaintext stringData fields differ in Kubernetes Secrets?▼

The `data` field requires base64-encoded strings, while `stringData` accepts unencoded UTF-8 plaintext. On admission, kube-apiserver encodes all `stringData` keys into `data` and removes `stringData` from persistent storage in etcd.

Why should production ConfigMaps and Secrets be marked as immutable: true?▼

Marking resources immutable disables watch caches across cluster nodes. When kubelet mounts an immutable volume, it skips periodic polling for changes, saving substantial CPU and network resources across massive deployments.

How are Docker registry credentials formatted in kubernetes.io/dockerconfigjson?▼

The Secret requires a single `.dockerconfigjson` key whose value is a base64-encoded JSON object following the format `{"auths":{"<registry-url>":{"username":"...","password":"...","auth":"base64(user:pass)"}}}`.

Does client-side generation in this tool expose credentials over the network?▼

No. All base64 encoding, schema validation, and manifest generation occur entirely within your browser's local JavaScript execution context. No secret data, tokens, or private keys are transmitted to any server.

Related Tools & Utilities

All Tools →
Kubernetes HorizontalPodAutoscaler (HPA v2) GeneratorDeveloper

Build autoscaling HPA v2 YAML manifests with CPU and Memory utilization targets, custom metrics, and scale-up/scale-down stabilization policies.

Open tool→
Redis (redis.conf) Production Config Builder & TunerDeveloper

Generate tuned redis.conf configuration files with maxmemory policies, RDB/AOF persistence, network binding, and security authentication.

Open tool→
PostgreSQL (postgresql.conf) Hardware Tuner & BuilderDeveloper

Calculate and generate optimized postgresql.conf settings based on hardware specs (shared_buffers, work_mem, effective_cache_size, max_connections).

Open tool→
Linux Systemd (.timer & .service) Unit GeneratorDeveloper

Build systemd timer and companion service unit files with OnCalendar scheduling, OnBootSec intervals, Persistent execution, and random delays.

Open tool→
TypeScript (tsconfig.json) Configuration GeneratorDeveloper

Generate modern, robust tsconfig.json configurations for Next.js, Node.js, Vite, or Library setups with strict mode, paths, and module resolution.

Open tool→
JSON to ClickHouse CREATE TABLE DDL GeneratorDeveloper

Convert sample JSON documents into ClickHouse SQL DDL with MergeTree engine, UInt/Int/Float/String/DateTime types, and Array/Nested column mappings.

Open tool→