Interview › Infrastructure as Code (Terraform, Ansible)

What is a configMapGenerator and secretGenerator, and what is the hash suffix for?

Infrastructure as Code (Terraform, Ansible) · Advanced level

Answer

configMapGenerator and secretGenerator create ConfigMaps and Secrets from literals, files, or env files. The generated resource name usually includes a content hash suffix so a change in config creates a new object name.

Technical explanation

Generators produce resources during build, so the generated output should be reviewed in CI.

The hash suffix is based on content, making config changes visible in resource names.

SecretGenerator helps construct Secret manifests but does not encrypt them by itself.

Keep source manifests or IaC definitions readable enough that reviewers can understand the final desired state.

Use overlays, modules, or roles for reuse, but keep environment-specific differences explicit and reviewable.

Validate generated output in CI before applying it through kubectl, Argo CD, Terraform, or Ansible.

Hands-on example

1. Create a Kustomize base and overlay for: What is a configMapGenerator and secretGenerator, and what is the hash suffix for?

2. Base files:

base/deployment.yaml

base/service.yaml

base/kustomization.yaml

base/kustomization.yaml:

resources:

- deployment.yaml

- service.yaml

commonLabels:

app.kubernetes.io/name: payments

3. prod overlay:

resources:

- ../../base

namePrefix: prod-

namespace: payments-prod

images:

- name: ghcr.io/company/payments

newTag: 1.8.4

configMapGenerator:

- name: app-config

literals:

- LOG_LEVEL=info

patches:

- path: replica-patch.yaml

4. Render and apply:

kubectl kustomize overlays/prod

kubectl diff -k overlays/prod

kubectl apply -k overlays/prod

5. In GitOps, point Argo CD at overlays/prod and let it render, compare, and sync the desired state.

More Infrastructure as Code (Terraform, Ansible) interview questions

• What is Infrastructure as Code, and what problems does it solve over click-ops?
• What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
• What is the difference between configuration management and provisioning?
• What is Terraform, and what is the core plan/apply workflow?
• What does terraform init do?
• What is the Terraform state file, and why is it critical?
• Why should state be stored remotely, and what backend would you use on AWS?
• What is state locking, and why does it matter for teams?

← All Infrastructure as Code (Terraform, Ansible) questions