Applications need configuration and data, and Kubernetes offers dedicated primitives for both. ConfigMaps store non-confidential key-value pairs that Pods consume as environment variables, command-line arguments, or mounted files, while Secrets hold sensitive material such as passwords, tokens, and TLS certificates. Secret data is base64-encoded by default rather than encrypted, so production clusters should enable encryption at rest via the kube-apiserver's --encryption-provider-config, and many teams use external secret managers like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault with operators such as the External Secrets Operator to sync values into Kubernetes Secrets. Common Secret types include Opaque for arbitrary key-value data, kubernetes.io/tls for certificates, and kubernetes.io/dockerconfigjson for registry credentials, the last of which is referenced from a Pod's imagePullSecrets list when pulling from private registries.
Storage in Kubernetes is decoupled into three layers. PersistentVolumes are cluster-level resources that exist independently of any Pod, provisioned manually by an admin or dynamically through a StorageClass that names a provisioner such as kubernetes.io/aws-ebs or pd.csi.storage.gke.io along with parameters, reclaimPolicy, and volumeBindingMode. PersistentVolumeClaims are user requests for storage with a desired size and access mode; Kubernetes binds a matching PV to the PVC, and Pods reference the claim in their volume spec. Access modes include ReadWriteOnce for single-node read-write, ReadOnlyMany for many-node read-only, ReadWriteMany for many-node read-write (supported by NFS, CephFS, EFS), and the newer ReadWriteOncePod for single-Pod access. Setting volumeBindingMode to WaitForFirstConsumer delays PV binding until a Pod is scheduled so the volume is created in the same zone as the Pod, avoiding Pending PVCs caused by zone mismatch. Beyond persistent storage, lighter-weight volumes exist for ephemeral use: emptyDir is created when a Pod is assigned to a node, lives for the Pod's lifetime, and is shared between containers, while hostPath mounts a directory from the host filesystem and is restricted under the restricted Pod Security Standard because it couples Pods to specific nodes. VolumeSnapshots capture point-in-time copies of PVCs through a VolumeSnapshotClass, enabling database-style backups and clones, and Container Storage Interface (CSI) drivers have been the standard since in-tree plugins were removed in v1.26.
Packaging and templating these resources is the role of Helm, the de facto package manager for Kubernetes. A Helm chart is a directory containing Chart.yaml with metadata, values.yaml with default configuration, a templates/ directory of Go-templated Kubernetes manifests, optional dependency sub-charts under charts/, and a README. Installing a chart creates a release, a running instance with a specific configuration, and the same chart can be installed multiple times with different names and values. Charts are discovered through repositories added with helm repo add, refreshed with helm repo update, and searched with helm search repo.