Managing Distributed Configuration
1. Externalizing Configuration
| Source | Use |
|---|
| Environment variables | 12-factor; container-friendly |
| Config files (mounted) | K8s ConfigMap as volume |
| Config server | Central HTTP endpoint |
| Sidecar fetcher | Pulls + reloads (e.g. consul-template) |
| Anti-pattern | Hard-coded values, env-specific builds |
2. Using Configuration Server
| Tool | Detail |
|---|
| Spring Cloud Config | Git-backed, encryption, profiles |
| HashiCorp Consul KV | KV store + watch |
| etcd | Watch + leases |
| AWS AppConfig / SSM | Managed, with deployment strategy |
| Azure App Configuration | Managed, label-based |
3. Implementing Configuration Refresh
| Mechanism | Detail |
|---|
| Polling | Periodic GET (simple, lag) |
| Long-poll / watch | Push on change (Consul, etcd) |
| Pub/Sub bus | Spring Cloud Bus, Kafka |
| Hot reload | @RefreshScope beans |
| Restart-only | Safer for critical settings |
4. Managing Secrets
| Tool | Detail |
|---|
| HashiCorp Vault | Dynamic secrets, leases, transit |
| AWS Secrets Manager / SSM | Managed, IAM-controlled |
| GCP Secret Manager / Azure Key Vault | Cloud-native |
| Kubernetes Secrets | Base64; combine with KMS / SealedSecrets / SOPS |
| External Secrets Operator | Sync from Vault/SM into K8s |
Warning: Never commit plaintext secrets to git. Use SOPS or SealedSecrets for GitOps flows.
5. Using Environment Variables
| Practice | Detail |
|---|
| Naming | SCREAMING_SNAKE_CASE |
| Prefix | APP_, service-specific |
| Defaults | Provide sane defaults in code |
| Validation | Fail-fast on missing required vars |
| Avoid | Putting secrets in env (visible in ps); use mounted files instead when possible |
6. Implementing Configuration Profiles
| Profile | Use |
|---|
| local | Developer machine; mocks |
| dev | Shared dev cluster |
| staging | Prod-like |
| prod | Production |
| Activation | SPRING_PROFILES_ACTIVE, env vars |
7. Versioning Configuration
| Approach | Detail |
|---|
| Git | Single source of truth; PR review |
| Tag/branch per env | Promote by merge |
| Rollback | Revert commit, re-apply |
| Audit | Git log = who/when/what |
8. Handling Configuration Hierarchy
| Priority (lowest → highest) | Source |
|---|
| 1 | Built-in defaults (code) |
| 2 | Bundled config files |
| 3 | Profile-specific config |
| 4 | Config server values |
| 5 | Environment variables |
| 6 | Command-line args |
9. Implementing Feature Flags
| Type | Detail |
|---|
| Release toggle | Hide unfinished feature |
| Experiment | A/B test variants |
| Ops toggle | Kill switches, throttles |
| Permission | Per-user/tenant rollout |
| Tools | LaunchDarkly, Unleash, Flagsmith, OpenFeature |
10. Using Configuration Encryption
| Technique | Detail |
|---|
| Envelope encryption | Data key encrypted by KMS master key |
| SOPS | Encrypts YAML/JSON keys with age/PGP/KMS |
| SealedSecrets | Bitnami; encrypted with cluster key |
| Spring Cloud Config | {cipher}... values |
11. Managing Configuration Schema
| Concern | Practice |
|---|
| Typed config | @ConfigurationProperties classes |
| Schema validation | JSON Schema, viper, koanf |
| Documentation | Generate from typed config |
| Migration | Versioned schema; backward compatible |
| Tool | Use Case |
|---|
| Ansible | Push config to VMs |
| Helm / Kustomize | K8s manifest templating |
| Argo CD / Flux | GitOps continuous reconciliation |
| Terraform | Cloud resource config (paramstore, secrets) |
| Crossplane | K8s-native cloud config |