How mounted ConfigMap updates propagate to pods
ConfigMap volume update semantics.
kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
What's really being asked
Whether you know that Kubernetes updating the file on disk is separate from your application using the new value, and the timing and exceptions involved.
The full answer
When a ConfigMap is mounted as a volume, the kubelet watches it and periodically reconciles the projected files. Propagation is not instant: the kubelet syncs on its periodic cycle, and there is additional delay from the local watch or cache, so a change typically appears in the pod within roughly a minute, on the order of the kubelet sync period plus cache TTL. The update is applied atomically: the volume is a directory of symlinks pointing at a timestamped data directory, and the kubelet creates a new directory and swaps the symlink so readers never see a half-written file. Crucially, the running application does not automatically notice. The files on disk change, but the process keeps using whatever it loaded at startup unless it actively watches the files for changes, for example with inotify or a config library, or is told to reload via a SIGHUP or a sidecar that triggers a reload. Two important exceptions: a ConfigMap mounted with a subPath does not receive updates and needs a pod restart, and values injected as environment variables are read only at container start and never update live.
The mistakes people make
Saying the application automatically picks up new values; only the files change, not the loaded config. Claiming updates are instantaneous. Forgetting that subPath mounts and env-var references do not update without a restart. Believing a rolling restart is always required, when a watch-and-reload app avoids it.
What usually comes next
How do tools like Reloader trigger a rollout on ConfigMap change? Why does subPath behave differently? How do immutable ConfigMaps and checksum annotations fit a deliberate-rollout strategy? What is the atomic symlink swap protecting against?
A concrete example
An nginx pod mounts its config from a ConfigMap volume. You edit the ConfigMap; about a minute later the file on disk shows the new server block thanks to the kubelet's atomic symlink swap. But nginx keeps serving the old config until you send it a reload signal. Teams often add a sidecar or a Reloader annotation that detects the change and triggers nginx -s reload or a rolling restart so the new config takes effect.
Interview question
You update a ConfigMap mounted as a volume. A minute later the file on disk shows the new value, but the app still uses the old one. Why?
- a.Environment-variable ConfigMaps update live but volume mounts do not
- b.The files updated, but the running process must watch or be signaled to reload; it does not re-read automaticallyCorrect
- c.The kubelet failed to sync; the file should still be old
- d.ConfigMap volume mounts never update without deleting the pod
Why? this is the answer
The kubelet atomically refreshes the mounted files, but the application keeps its startup-loaded config unless it watches the files or receives a reload signal. Env-var injection, by contrast, never updates live.
Just read this? Test yourself on what you have been reading.
- #kubernetes
- #configmap
- #volumes
- #kubelet
- #configuration
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on kubernetes — each one lists the topics its interview covers.
See open roles