ConfigMaps to Hold AI Application Credentials and Secrets

Question

Pulumi · Accepted Answer

ConfigMaps in Kubernetes are API objects that allow you to store non-confidential data in key-value pairs. They can be consumed by pods or used to store configuration settings for your applications. However, for sensitive information such as credentials and secrets, you should use the `Secret` resource in Kubernetes, which is more suitable for storing secrets because it provides a way to store and manage sensitive information such as passwords, OAuth tokens, and ssh keys, with more control over how this information is used and less risk of accidental exposure.

When using Pulumi to manage your Kubernetes infrastructure, you can define and manage these resources in your infrastructure as code. Below is a Pulumi program, written in Python, that creates a `ConfigMap` and a `Secret` object in Kubernetes to manage your AI application's configuration and secrets.

First, it will create a `ConfigMap` with dummy configuration data for the purpose of this example. For secrets, we'll create a `Secret` object — note that secrets are base64-encoded, and Pulumi provides a way to automatically encode them for you. Additionally, while Pulumi can handle sensitive information securely, you should be cautious with how you handle secrets in your code and avoid committing them to version control.

Let's write a program that demonstrates how to create a `ConfigMap` and a `Secret` in Kubernetes:

```python
import pulumi
from pulumi_kubernetes.core.v1 import ConfigMap, Secret
from pulumi_kubernetes.meta.v1 import ObjectMeta

# Define metadata for resources (to be re-used).
metadata = ObjectMeta(
    # Give a name to your configmap and secret
    name="ai-app-config",
    # Define the namespace - if you have a specific namespace, replace 'default' with your namespace
    namespace="default",
)

# A ConfigMap to hold configuration data
config_map = ConfigMap(
    "ai-app-configmap",
    metadata=metadata,
    # Here we insert dummy configuration data as an example
    data={
        "api_url": "https://example.ai-service.com/api",
        "log_level": "info",
    },
    opts=pulumi.ResourceOptions(description="Holds non-sensitive configuration data for the AI application")
)

# A Secret to hold sensitive data such as credentials or API keys
secret = Secret(
    "ai-app-secret",
    metadata=metadata,
    # Secrets are base64 encoded. Pulumi will encode the values for us.
    # Replace the values with your actual secrets.
    string_data={
        "api_key": "supersecretapikey",
        "db_password": "supersecretdbpassword",
    },
    opts=pulumi.ResourceOptions(description="Holds sensitive data like API keys and passwords for the AI application")
)

# Export the name of the ConfigMap and Secret. This will be visible in the Pulumi output.
pulumi.export("configMapName", config_map.metadata["name"])
pulumi.export("secretName", secret.metadata["name"])
```

In the above program:
- We define a `metadata` object that specifies the name and namespace for our Kubernetes resources.
- `ConfigMap` is created with dummy configuration values. Replace these with your actual configuration values.
- `Secret` holds the API key and database password. The `string_data` field takes a dictionary, and Pulumi will handle the base64 encoding for you.
- These resources are labeled with a description that can help identify their purpose and content when reviewing the Pulumi stack resources.
- Lastly, the names of the created resources are exported so that you can easily reference them.

Make sure you replace the placeholder data with the actual configuration and secrets that your AI application requires. Store sensitive information securely and preferably use Pulumi's secrets management to reference sensitive data instead of hardcoding it into your Pulumi program.

Remember, this code is designed to be a starting point. Depending on the actual application and its requirements, you may need to customize the configuration or manipulate the secrets differently. Always test this in a safe environment before using it in production.