> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Why Generators

> This article explains how to automate pod rollouts in Kubernetes when ConfigMaps or Secrets are updated.

In Kubernetes, workloads often rely on ConfigMaps or Secrets for configuration data. However, when these resources change, pods do not automatically pick up the updates. Config generators (and secret generators) solve this by automating rollouts whenever underlying ConfigMaps or Secrets are modified. In this lesson, we’ll demonstrate this problem and prepare for the next section on generators.

## Initial Setup

### 1. Create a ConfigMap for Database Credentials

First, define a ConfigMap to hold your database password. In production, you should use a Secret, but for demonstration the behavior is identical.

```yaml theme={null}
apiVersion: v1
kind: ConfigMap
metadata:
  name: db-credentials
data:
  password: "password1"
```

<Callout icon="lightbulb" color="#1CB2FE">
  Use a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) in real deployments to protect sensitive data.
</Callout>

Save this as `configmap.yaml` and apply:

```bash theme={null}
kubectl apply -f configmap.yaml
```

### 2. Deploy an NGINX Pod Referencing the ConfigMap

Next, deploy an NGINX container that injects the password as an environment variable:

```yaml theme={null}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      component: nginx
  template:
    metadata:
      labels:
        component: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          env:
            - name: DB_PASSWORD
              valueFrom:
                configMapKeyRef:
                  name: db-credentials
                  key: password
```

Save as `deployment.yaml` and apply:

```bash theme={null}
kubectl apply -f deployment.yaml
```

## Verifying the Environment Variable

1. List the running pods:

   ```bash theme={null}
   kubectl get pods
   ```

2. Exec into the NGINX pod and print the `DB_PASSWORD`:

   ```bash theme={null}
   POD=$(kubectl get pods -l component=nginx -o jsonpath="{.items[0].metadata.name}")
   kubectl exec "$POD" -- printenv | grep -i db
   ```

Expected output:

```text theme={null}
DB_PASSWORD=password1
```

## Changing the Password

After some time, update the database password in your ConfigMap:

```yaml theme={null}
apiVersion: v1
kind: ConfigMap
metadata:
  name: db-credentials
data:
  password: "password2"
```

Reapply the manifest:

```bash theme={null}
kubectl apply -f configmap.yaml
```

Even though the ConfigMap reflects the new value:

```bash theme={null}
kubectl describe configmap db-credentials
```

```text theme={null}
Data
====
password:
----
password2
```

the pod still reports the old password:

```bash theme={null}
kubectl exec "$POD" -- printenv | grep -i db
# DB_PASSWORD=password1
```

<Callout icon="triangle-alert" color="#FF6B6B">
  Kubernetes does **not** automatically redeploy pods when a referenced ConfigMap or Secret is updated. You must manually trigger a restart.
</Callout>

## Manual Rollout Restart

To pick up the new password, force a rollout restart of the deployment:

```bash theme={null}
kubectl rollout restart deployment nginx-deployment
```

Watch for the new pod:

```bash theme={null}
kubectl get pods
```

Verify the updated environment variable:

```bash theme={null}
NEW_POD=$(kubectl get pods -l component=nginx -o jsonpath="{.items[0].metadata.name}")
kubectl exec "$NEW_POD" -- printenv | grep -i db
# DB_PASSWORD=password2
```

## Common Kubectl Commands

| Command                                     | Purpose                              |
| ------------------------------------------- | ------------------------------------ |
| `kubectl apply -f configmap.yaml`           | Create or update a ConfigMap         |
| `kubectl apply -f deployment.yaml`          | Create or update a Deployment        |
| `kubectl get pods`                          | List all pods                        |
| `kubectl exec <pod> -- printenv`            | Inspect environment variables in pod |
| `kubectl rollout restart deployment <name>` | Restart pods to pick up changes      |

## The Challenge

Every time a ConfigMap or Secret changes, Kubernetes leaves existing pods untouched. Manually restarting each deployment can become error-prone at scale.

In the next section, we’ll introduce config generators to automate this process, ensuring your applications always run with the latest configuration.

## References

* [Kubernetes ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/)
* [Kubernetes Secret](https://kubernetes.io/docs/concepts/configuration/secret/)
* [kubectl rollout restart](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#rollout)
* [Kubernetes Documentation](https://kubernetes.io/docs/)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/kustomize/module/51823d3e-7be4-4792-836a-2c4690c0c547/lesson/1481509c-b71c-4836-8e1b-d55117f5c673" />
</CardGroup>