ConfigMap + Secret in a Pod

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  LOG_LEVEL: "info"
---
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
# stringData takes plain text and lets Kubernetes base64-encode it for
# you -- "data" would require you to pre-encode every value yourself.
stringData:
  password: change-me
---
apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  containers:
    - name: app
      image: docktionary/app:1.4.0
      # envFrom dumps every key in the ConfigMap in as an env var -- fine
      # for non-secret config you're not trying to name individually.
      envFrom:
        - configMapRef:
            name: app-config
      # Secrets are pulled in one key at a time instead, so the Pod spec
      # states exactly which secret values it actually uses.
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: password