Separate configuration from container images using ConfigMaps and Secrets.
ConfigMaps: Non-sensitive configuration
kubectl create configmap app-config --from-literal=LOG_LEVEL=info
Secrets: Sensitive data (base64 encoded, not encrypted by default)
kubectl create secret generic db-creds --from-literal=password=secret123
Usage: Mount as files or inject as environment variables.
Interview tip: Know that Secrets are base64 encoded, not encrypted. For real security, use external secret managers like Vault or cloud-native solutions.