Immutable Config

Immutable Config

Immutable ConfigMaps and Secrets

Setting immutable: true (stable since Kubernetes 1.21 5,150 ) freezes data. The kubelet then stops watching the object, which cuts API-server load in clusters with thousands of mounts, and nobody can change a running app's configuration by accident:

An immutable ConfigMap rejects editsShell

kubectl create configmap web-settings-v1 --from-literal=PAGE_SIZE=20 --dry-run=client -o yaml |
  yq '.immutable = true' | kubectl apply -f -
kubectl patch configmap web-settings-v1 -p '{"data": {"PAGE_SIZE": "50"}}'

Output

configmap/web-settings-v1 created
The ConfigMap "web-settings-v1" is invalid: data: Forbidden: field is immutable when
  `immutable` is set

The flag cannot be removed; to change the values, create web-settings-v2 and point the Deployment at it, which also triggers a rollout that you can undo. Kustomize 547,809 's configMapGenerator (Kustomize Overlays) automates this by appending a content hash to the name.

MENU