Env config hygiene with ConfigMap

Not every env var is a secret. Provider name, model id, worker count, and index path are operational knobs, not credentials. Put them in a ConfigMap so you can tune the service without touching the Secret.

k8s/configmap.yaml

yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: enterprise-rag-config
  labels:
    app: enterprise-rag
data:
  LLM_PROVIDER: 'openrouter'
  OPENROUTER_MODEL: 'minimax/minimax-m2:free'
  EMBEDDING_MODEL: 'all-MiniLM-L6-v2'
  RAY_NUM_WORKERS: '2'
  RAY_BATCH_SIZE: '32'
  CHROMA_PERSIST_DIR: '/data/chroma'
  API_HOST: '0.0.0.0'
  API_PORT: '8000'

Non-secret operational config. Changing RAY_NUM_WORKERS or the embedding model is a config push, not a code change. Review and approval still apply, but the mental cost is lower.

k8s/deployment.yaml (envFrom)

yaml

envFrom:
  - configMapRef:
      name: enterprise-rag-config
  - secretRef:
      name: enterprise-rag-secrets

envFrom flattens every key in the ConfigMap and Secret into the container env. The app code sees the same os.getenv regardless of whether a value came from a ConfigMap or a Secret.

Matching exercise: Which object owns each setting?

Loading practice…