ConfigMap: Configuration as a Kubernetes Object

2 min read

Prerequisites: kubernetes-manifest

A ConfigMap stores non-secret configuration in the Kubernetes API. A Pod can consume that configuration as environment variables, command arguments, or files. The dashboard uses a fourth pattern built on the same API: a sidecar watches selected ConfigMaps and copies their data into a shared filesystem.

The Devata Overview ConfigMap has three separate jobs:

  1. hold the dashboard JSON under data.devata-overview.json;
  2. identify itself to the dashboard sidecar with grafana_dashboard: "1";
  3. request /tmp/dashboards/Devata as its destination with the grafana_folder annotation.

The filename comes from the data key. The contents come from the data value:

ConfigMap data key          filesystem result
devata-overview.json   ->   /tmp/dashboards/Devata/devata-overview.json

This is configuration, not a secret. Dashboard JSON contains panel layout, descriptions, links, and PromQL expressions. It must not contain the Grafana admin password, bearer tokens, or datasource credentials. Those belong in a Kubernetes Secret, and devata already supplies the Grafana administrator credential through the separate grafana-admin Secret.

Why use a ConfigMap instead of baking the file into an image?

An image should hold the program. A ConfigMap holds configuration that changes on a different schedule. Keeping the dashboard outside the Grafana image means:

  • a panel change does not require building a new Grafana image;
  • Git shows the exact JSON diff;
  • Argo CD can reconcile the object independently;
  • the stock Grafana chart and image remain replaceable;
  • the same sidecar contract can discover more dashboards later.

The ConfigMap is not the durable source of truth. Git is. The live object can be deleted and Argo CD can recreate it because the manifest remains in the lab repository. The file copied into /tmp is even more disposable. That is safe because both runtime layers can be rebuilt from Git.

Observe the live object

kubectl -n monitoring get configmap grafana-dashboard-devata-overview \
  -o jsonpath='{.metadata.labels.grafana_dashboard}{"\n"}{.metadata.annotations.grafana_folder}{"\n"}'
 
kubectl -n monitoring get configmap grafana-dashboard-devata-overview \
  -o jsonpath='{.data.devata-overview\.json}' \
  | jq '{uid, title, panels: (.panels | length)}'

The expected identity is devata-overview, the expected title is Devata Overview, and the dashboard currently has 14 panels.

Official reference: ConfigMaps.