How do ConfigMaps and Secrets differ, and how can they be consumed by a Pod?

• A. ConfigMaps store non-sensitive config data; Secrets store sensitive data. Both can be mounted as files or exposed as environment variables.
• B. ConfigMaps store secrets; Secrets store non-sensitive data.
• C. They are interchangeable.
• D. They can only be used as environment variables, not mounted.

Answer: (A)

ConfigMaps are for non-sensitive configuration data, while Secrets are for sensitive information like passwords, tokens, or keys. In a Pod, you can bring either into the container in two flexible ways: you can mount them as a volume, which makes each key appear as a file inside the container so the app can read configuration from files; or you can expose their keys as environment variables, using envFrom or explicit env entries so the application can read values from the process environment.

A practical pattern is to store typical app configuration in a ConfigMap and keep credentials in a Secret. Kubernetes handles how these data sources are stored and accessed, with Secrets supported by the same consumption methods as ConfigMaps (volumes or environment variables). Secrets are typically encoded in manifests (and may be encrypted at rest depending on cluster configuration) and access is controlled via RBAC, so they remain safer to handle in your deployment.

That’s why the described option is best: it correctly distinguishes ConfigMaps from Secrets and confirms both can be consumed by a Pod either as mounted files or as environment variables.