---
layout: docs
page_title: Kubernetes - ConfigMaps and Secrets
description: |-
  Waypoint provides multiple options for accessing ConfigMap and Secret resources within your deployed application. This can be used or instead of Waypoint's native application configuration.
---

# ConfigMaps and Secrets

Waypoint provides multiple options for accessing ConfigMap and Secret resources
within your deployed application. This can be used or instead of Waypoint's native
[application configuration](/docs/app-config) functionality.

This page will focus on Waypoint-specific mechanisms for injecting
configuration into your application, and it all requires the
[Waypoint Entrypoint](/docs/entrypoint) to be injected and configured.
Please note that **if you're using the [Helm](/docs/kubernetes/helm-deploy) or
[`kubernetes-apply`](/docs/kubernetes/kubectl-deploy) deployment plugins,
you do not need to use the Waypoint entrypoint** and you can access
ConfigMaps and Secrets using
[standard Kubernetes practices](https://kubernetes.io/docs/concepts/configuration/configmap/).
Even if you are using Helm or raw YAML, you can also mix in any of the
techniques noted below as well.

## Environment Variables

You can set environment variables for your application directly
in the `waypoint.hcl` file using the [`config` stanza](/docs/waypoint-hcl/config).
Static environment variables like this can also be set using the
[web UI or CLI](/docs/app-config).

```hcl
config {
  env = {
    MY_API_KEY = "abcd1234"
  }
}

app "my-app" {
  // ...
}
```

But, it's not a good idea to put something like an API key directly
in your Waypoint configuration. A better idea would be to use a Kubernetes
Secret and access it from there. Waypoint lets you do this with
[dynamic configuration](/docs/app-config/dynamic):

```hcl
config {
  env = {
    MY_API_KEY = dynamic("kubernetes", {
      name   = "my-secret" # Secret name
      key    = "apiKey"
      secret = true
    })
  }
}

app "my-app" {
  // ...
}
```

## Files

You can also create files from configuration values. For example, if we
wanted to create a JSON file with our API key from the environment variable
example above, we can do the following:

```hcl
config {
  internal = {
    MY_API_KEY = dynamic("kubernetes", {
      name   = "my-secret" # Secret name
      key    = "apiKey"
      secret = true
    })
  }

  file = {
    "config/config.json" = templatefile("${path.project}/config.json", {
      api_key = config.internal.MY_API_KEY,
    })
  }
}

app "my-app" {
  // ...
}
```

```json
{
  "api_key": "${api_key}"
}
```

This example shows two new concepts: [internal variables](/docs/app-config/internal)
for creating intermediary values that can be used in other configuration
values and [files](/docs/app-config/files) for creating configuration files.

The file `config/config.json` will be written relative to your application
deployment path. You could also specify an absolute path if you want the
file to be written in an exact location. The files are written by a user with
the same permissions as the running application when deployed, so ensure it is
a path you have permission to write to.

### File Change Notification

If an input to a configuration file changes while the application is deployed,
Waypoint will send a signal to the deployed application (by default `SIGUSR2`).
The application can listen for this signal to reload configuration.

For example, if you change the `my-secret` secret (as used in the example above)
_after_ you had already deployed your application, Waypoint would detect
the change, update the file, and then send a `SIGUSR2` signal to your
running application.

This is a big improvement over native Kubernetes mechanisms which update the
file but depend on the running application to watch the filesystem for changes.
For more information, including how to change the signal Waypoint sends,
see [the reference documentation](/docs/app-config/files#file-change-signal).
