MACRO NEPAL
ConfigMap and Secret Reloading in Java: Complete Implementation Guide
awiskar acharya
November 18, 2025
9:45 am

Introduction

In Kubernetes, ConfigMaps and Secrets are used to manage configuration data and sensitive information. However, when these resources are updated, applications don't automatically reload the new configuration. This guide covers multiple strategies to implement ConfigMap and Secret reloading in Java applications running in Kubernetes.

Architecture Overview

[Kubernetes] → [ConfigMap/Secret] → [File System] → [File Watcher] → [Application] → [Configuration Reload]
↓              ↓                   ↓              ↓               ↓               ↓
kubectl       Volume Mount       Config Files    Watch Service   Spring Beans    Dynamic Updates
Operator      Environment Vars   Symlinks        Polling         Configuration   Bean Refresh
GitOps        External Secrets   Sidecar        Inotify         Properties      Cache Clear

Step 1: Project Dependencies

Maven Configuration

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0">
<modelVersion>4.0.0</modelVersion>
<groupId>com.example</groupId>
<artifactId>config-reload</artifactId>
<version>1.0.0</version>
<packaging>jar</packaging>
<properties>
<maven.compiler.source>17</maven.compiler.source>
<maven.compiler.target>17</maven.compiler.target>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<spring-boot.version>3.2.0</spring-boot.version>
<kubernetes-client.version>6.8.1</kubernetes-client.version>
<micrometer.version>1.12.0</micrometer.version>
</properties>
<dependencies>
<!-- Spring Boot -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<version>${spring-boot.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
<version>${spring-boot.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
<version>${spring-boot.version}</version>
</dependency>
<!-- Configuration Processor -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-configuration-processor</artifactId>
<version>${spring-boot.version}</version>
<optional>true</optional>
</dependency>
<!-- Kubernetes Client -->
<dependency>
<groupId>io.kubernetes</groupId>
<artifactId>client-java</artifactId>
<version>${kubernetes-client.version}</version>
</dependency>
<dependency>
<groupId>io.kubernetes</groupId>
<artifactId>client-java-api-fluent</artifactId>
<version>${kubernetes-client.version}</version>
</dependency>
<!-- Metrics -->
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-core</artifactId>
<version>${micrometer.version}</version>
</dependency>
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-registry-prometheus</artifactId>
<version>${micrometer.version}</version>
</dependency>
<!-- JSON -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.15.0</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.15.0</version>
</dependency>
<!-- YAML -->
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
<version>2.15.0</version>
</dependency>
<!-- Testing -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<version>${spring-boot.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>junit-jupiter</artifactId>
<version>1.18.3</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>${spring-boot.version}</version>
</plugin>
</plugins>
</build>
</project>

Step 2: Kubernetes Manifests

ConfigMap and Secret Definitions

k8s/configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
namespace: default
labels:
app: java-app
data:
application.yaml: |
app:
name: "Config Reload Demo"
version: "1.0.0"
database:
url: "jdbc:postgresql://localhost:5432/mydb"
pool:
min-size: 2
max-size: 10
timeout: 30000
features:
dark-mode: true
experimental-features: false
rate-limiting:
enabled: true
requests-per-minute: 100
logging:
level:
com.example: INFO
org.springframework: WARN
feature-flags.yaml: |
features:
new-ui:
enabled: false
rollout-percentage: 10
payment-v2:
enabled: true
rollout-percentage: 50
search-v3:
enabled: false
rollout-percentage: 0

k8s/secret.yaml

apiVersion: v1
kind: Secret
metadata:
name: app-secrets
namespace: default
labels:
app: java-app
type: Opaque
data:
database-password: c3VwZXJzZWNyZXRwYXNzd29yZA==  # base64 encoded
api-key: YXBpLWtleS1zZWNyZXQ=
jwt-secret: anN0LXNlY3JldC1rZXk=

Deployment with Volume Mounts

k8s/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
name: java-app
namespace: default
labels:
app: java-app
spec:
replicas: 2
selector:
matchLabels:
app: java-app
template:
metadata:
labels:
app: java-app
annotations:
# Trigger redeploy when config changes
config.hash: "${CONFIG_HASH}"
secret.hash: "${SECRET_HASH}"
spec:
containers:
- name: java-app
image: myapp:latest
ports:
- containerPort: 8080
env:
- name: SPRING_PROFILES_ACTIVE
value: "kubernetes"
- name: CONFIG_RELOAD_ENABLED
value: "true"
- name: CONFIG_RELOAD_INTERVAL
value: "30000"
# Mount ConfigMap and Secret as volumes
volumeMounts:
- name: config-volume
mountPath: /etc/app/config
readOnly: true
- name: secret-volume
mountPath: /etc/app/secrets
readOnly: true
- name: temp-volume
mountPath: /tmp
# Resource limits
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "1Gi"
cpu: "500m"
# Liveness and readiness probes
livenessProbe:
httpGet:
path: /actuator/health/liveness
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /actuator/health/readiness
port: 8080
initialDelaySeconds: 15
periodSeconds: 5
timeoutSeconds: 3
# Security context
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
# Volumes from ConfigMap and Secret
volumes:
- name: config-volume
configMap:
name: app-config
items:
- key: application.yaml
path: application.yaml
- key: feature-flags.yaml
path: feature-flags.yaml
- name: secret-volume
secret:
secretName: app-secrets
items:
- key: database-password
path: database-password
- key: api-key
path: api-key
- key: jwt-secret
path: jwt-secret
- name: temp-volume
emptyDir: {}
# Security context
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000

Step 3: Configuration Models

Application Configuration

AppConfig.java

package com.example.configreload.model;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;
import jakarta.validation.constraints.Positive;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import java.util.Map;
@ConfigurationProperties(prefix = "app")
@Validated
public class AppConfig {
@NotBlank
private String name;
@NotBlank
private String version;
@NotNull
private DatabaseConfig database;
@NotNull
private FeaturesConfig features;
@NotNull
private LoggingConfig logging;
// Getters and Setters
public String getName() { return name; }
public void setName(String name) { this.name = name; }
public String getVersion() { return version; }
public void setVersion(String version) { this.version = version; }
public DatabaseConfig getDatabase() { return database; }
public void setDatabase(DatabaseConfig database) { this.database = database; }
public FeaturesConfig getFeatures() { return features; }
public void setFeatures(FeaturesConfig features) { this.features = features; }
public LoggingConfig getLogging() { return logging; }
public void setLogging(LoggingConfig logging) { this.logging = logging; }
public static class DatabaseConfig {
@NotBlank
private String url;
@Positive
private int minSize;
@Positive
private int maxSize;
@Positive
private long timeout;
// Getters and Setters
public String getUrl() { return url; }
public void setUrl(String url) { this.url = url; }
public int getMinSize() { return minSize; }
public void setMinSize(int minSize) { this.minSize = minSize; }
public int getMaxSize() { return maxSize; }
public void setMaxSize(int maxSize) { this.maxSize = maxSize; }
public long getTimeout() { return timeout; }
public void setTimeout(long timeout) { this.timeout = timeout; }
}
public static class FeaturesConfig {
private boolean darkMode;
private boolean experimentalFeatures;
@NotNull
private RateLimitingConfig rateLimiting;
// Getters and Setters
public boolean isDarkMode() { return darkMode; }
public void setDarkMode(boolean darkMode) { this.darkMode = darkMode; }
public boolean isExperimentalFeatures() { return experimentalFeatures; }
public void setExperimentalFeatures(boolean experimentalFeatures) { this.experimentalFeatures = experimentalFeatures; }
public RateLimitingConfig getRateLimiting() { return rateLimiting; }
public void setRateLimiting(RateLimitingConfig rateLimiting) { this.rateLimiting = rateLimiting; }
public static class RateLimitingConfig {
private boolean enabled;
@Positive
private int requestsPerMinute;
// Getters and Setters
public boolean isEnabled() { return enabled; }
public void setEnabled(boolean enabled) { this.enabled = enabled; }
public int getRequestsPerMinute() { return requestsPerMinute; }
public void setRequestsPerMinute(int requestsPerMinute) { this.requestsPerMinute = requestsPerMinute; }
}
}
public static class LoggingConfig {
@NotNull
private Map<String, String> level;
// Getters and Setters
public Map<String, String> getLevel() { return level; }
public void setLevel(Map<String, String> level) { this.level = level; }
}
}

Feature Flags Configuration

FeatureFlags.java

package com.example.configreload.model;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import java.util.Map;
@ConfigurationProperties(prefix = "features")
@Validated
public class FeatureFlags {
private Map<String, FeatureFlag> features;
// Getters and Setters
public Map<String, FeatureFlag> getFeatures() { return features; }
public void setFeatures(Map<String, FeatureFlag> features) { this.features = features; }
public static class FeatureFlag {
private boolean enabled;
private int rolloutPercentage;
// Getters and Setters
public boolean isEnabled() { return enabled; }
public void setEnabled(boolean enabled) { this.enabled = enabled; }
public int getRolloutPercentage() { return rolloutPercentage; }
public void setRolloutPercentage(int rolloutPercentage) { this.rolloutPercentage = rolloutPercentage; }
}
}

Secrets Configuration

AppSecrets.java

package com.example.configreload.model;
import jakarta.validation.constraints.NotBlank;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
@ConfigurationProperties(prefix = "secrets")
@Validated
public class AppSecrets {
@NotBlank
private String databasePassword;
@NotBlank
private String apiKey;
@NotBlank
private String jwtSecret;
// Getters and Setters
public String getDatabasePassword() { return databasePassword; }
public void setDatabasePassword(String databasePassword) { this.databasePassword = databasePassword; }
public String getApiKey() { return apiKey; }
public void setApiKey(String apiKey) { this.apiKey = apiKey; }
public String getJwtSecret() { return jwtSecret; }
public void setJwtSecret(String jwtSecret) { this.jwtSecret = jwtSecret; }
}

Step 4: File System Watcher Strategy

File System Configuration Watcher

FileSystemConfigWatcher.java

package com.example.configreload.watcher;
import com.example.configreload.event.ConfigReloadEvent;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.stereotype.Component;
import javax.annotation.PostConstruct;
import javax.annotation.PreDestroy;
import java.io.File;
import java.io.IOException;
import java.nio.file.*;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
@Component
public class FileSystemConfigWatcher {
private static final Logger logger = LoggerFactory.getLogger(FileSystemConfigWatcher.class);
private final ApplicationEventPublisher eventPublisher;
private final ScheduledExecutorService scheduler;
private WatchService watchService;
private boolean watching = false;
@Value("${app.config.path:/etc/app/config}")
private String configPath;
@Value("${app.secrets.path:/etc/app/secrets}")
private String secretsPath;
@Value("${app.config.reload.enabled:true}")
private boolean reloadEnabled;
@Value("${app.config.reload.interval:30000}")
private long reloadInterval;
public FileSystemConfigWatcher(ApplicationEventPublisher eventPublisher) {
this.eventPublisher = eventPublisher;
this.scheduler = Executors.newSingleThreadScheduledExecutor(r -> {
Thread t = new Thread(r, "config-watcher");
t.setDaemon(true);
return t;
});
}
@PostConstruct
public void init() {
if (!reloadEnabled) {
logger.info("Config reload is disabled");
return;
}
try {
startWatching();
startPolling();
logger.info("Started config and secret watcher");
} catch (IOException e) {
logger.error("Failed to start config watcher", e);
}
}
@PreDestroy
public void destroy() {
watching = false;
scheduler.shutdown();
if (watchService != null) {
try {
watchService.close();
} catch (IOException e) {
logger.error("Error closing watch service", e);
}
}
}
private void startWatching() throws IOException {
watchService = FileSystems.getDefault().newWatchService();
Path configDir = Path.of(configPath);
Path secretsDir = Path.of(secretsPath);
if (Files.exists(configDir)) {
configDir.register(watchService, 
StandardWatchEventKinds.ENTRY_MODIFY,
StandardWatchEventKinds.ENTRY_CREATE,
StandardWatchEventKinds.ENTRY_DELETE);
logger.info("Watching config directory: {}", configDir);
}
if (Files.exists(secretsDir)) {
secretsDir.register(watchService,
StandardWatchEventKinds.ENTRY_MODIFY,
StandardWatchEventKinds.ENTRY_CREATE,
StandardWatchEventKinds.ENTRY_DELETE);
logger.info("Watching secrets directory: {}", secretsDir);
}
watching = true;
// Start watch service in background thread
scheduler.execute(this::watchFiles);
}
private void startPolling() {
// Fallback polling mechanism
scheduler.scheduleAtFixedRate(this::checkForChanges, 
reloadInterval, reloadInterval, TimeUnit.MILLISECONDS);
}
private void watchFiles() {
while (watching) {
try {
WatchKey key = watchService.take();
for (WatchEvent<?> event : key.pollEvents()) {
WatchEvent.Kind<?> kind = event.kind();
if (kind == StandardWatchEventKinds.OVERFLOW) {
continue;
}
@SuppressWarnings("unchecked")
WatchEvent<Path> ev = (WatchEvent<Path>) event;
Path filename = ev.context();
logger.info("File change detected: {} - {}", kind.name(), filename);
// Determine what type of file changed
if (filename.toString().endsWith(".yaml") || filename.toString().endsWith(".yml")) {
publishReloadEvent("CONFIG", filename.toString());
} else {
publishReloadEvent("SECRET", filename.toString());
}
}
boolean valid = key.reset();
if (!valid) {
logger.warn("Watch key no longer valid");
break;
}
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
logger.info("Config watcher interrupted");
break;
} catch (ClosedWatchServiceException e) {
logger.info("Watch service closed");
break;
} catch (Exception e) {
logger.error("Error in file watcher", e);
}
}
}
private void checkForChanges() {
try {
// Check config files
checkDirectoryForChanges(configPath, "CONFIG");
// Check secret files
checkDirectoryForChanges(secretsPath, "SECRET");
} catch (Exception e) {
logger.error("Error checking for config changes", e);
}
}
private void checkDirectoryForChanges(String directoryPath, String type) {
File dir = new File(directoryPath);
if (!dir.exists() || !dir.isDirectory()) {
return;
}
File[] files = dir.listFiles();
if (files == null) return;
for (File file : files) {
long lastModified = file.lastModified();
Long previousModified = FileModificationCache.getLastModified(file.getAbsolutePath());
if (previousModified == null || lastModified > previousModified) {
logger.info("{} file changed: {}", type, file.getName());
FileModificationCache.updateLastModified(file.getAbsolutePath(), lastModified);
publishReloadEvent(type, file.getName());
}
}
}
private void publishReloadEvent(String configType, String fileName) {
ConfigReloadEvent event = new ConfigReloadEvent(this, configType, fileName);
eventPublisher.publishEvent(event);
}
// Cache for file modification times
private static class FileModificationCache {
private static final java.util.Map<String, Long> cache = new java.util.concurrent.ConcurrentHashMap<>();
public static Long getLastModified(String filePath) {
return cache.get(filePath);
}
public static void updateLastModified(String filePath, long lastModified) {
cache.put(filePath, lastModified);
}
public static void remove(String filePath) {
cache.remove(filePath);
}
}
}

Configuration Reload Event

ConfigReloadEvent.java

package com.example.configreload.event;
import org.springframework.context.ApplicationEvent;
public class ConfigReloadEvent extends ApplicationEvent {
private final String configType; // CONFIG or SECRET
private final String fileName;
private final long timestamp;
public ConfigReloadEvent(Object source, String configType, String fileName) {
super(source);
this.configType = configType;
this.fileName = fileName;
this.timestamp = System.currentTimeMillis();
}
// Getters
public String getConfigType() { return configType; }
public String getFileName() { return fileName; }
public long getTimestamp() { return timestamp; }
public boolean isConfigChange() {
return "CONFIG".equals(configType);
}
public boolean isSecretChange() {
return "SECRET".equals(configType);
}
}

Step 5: Kubernetes API Watcher Strategy

Kubernetes ConfigMap Watcher

KubernetesConfigWatcher.java

package com.example.configreload.watcher;
import com.example.configreload.event.ConfigReloadEvent;
import io.kubernetes.client.openapi.ApiClient;
import io.kubernetes.client.openapi.ApiException;
import io.kubernetes.client.openapi.Configuration;
import io.kubernetes.client.openapi.apis.CoreV1Api;
import io.kubernetes.client.openapi.models.V1ConfigMap;
import io.kubernetes.client.openapi.models.V1ConfigMapList;
import io.kubernetes.client.openapi.models.V1Secret;
import io.kubernetes.client.openapi.models.V1SecretList;
import io.kubernetes.client.util.Config;
import io.kubernetes.client.util.Watch;
import okhttp3.OkHttpClient;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.stereotype.Component;
import javax.annotation.PostConstruct;
import javax.annotation.PreDestroy;
import java.io.IOException;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
@Component
public class KubernetesConfigWatcher {
private static final Logger logger = LoggerFactory.getLogger(KubernetesConfigWatcher.class);
private final ApplicationEventPublisher eventPublisher;
private final ScheduledExecutorService scheduler;
private boolean watching = false;
@Value("${app.configmap.name:app-config}")
private String configMapName;
@Value("${app.secret.name:app-secrets}")
private String secretName;
@Value("${app.namespace:default}")
private String namespace;
@Value("${app.config.reload.enabled:true}")
private boolean reloadEnabled;
@Value("${kubernetes.watch.enabled:true}")
private boolean kubernetesWatchEnabled;
private CoreV1Api api;
public KubernetesConfigWatcher(ApplicationEventPublisher eventPublisher) {
this.eventPublisher = eventPublisher;
this.scheduler = Executors.newScheduledThreadPool(2, r -> {
Thread t = new Thread(r, "k8s-watcher");
t.setDaemon(true);
return t;
});
}
@PostConstruct
public void init() {
if (!reloadEnabled || !kubernetesWatchEnabled) {
logger.info("Kubernetes config watcher is disabled");
return;
}
try {
initializeKubernetesClient();
startWatching();
logger.info("Started Kubernetes config and secret watcher");
} catch (Exception e) {
logger.error("Failed to initialize Kubernetes watcher", e);
// Fall back to file system watching
}
}
@PreDestroy
public void destroy() {
watching = false;
scheduler.shutdown();
}
private void initializeKubernetesClient() throws IOException {
// Try to load from cluster first, then fall back to default
try {
ApiClient client = Config.fromCluster();
Configuration.setDefaultApiClient(client);
} catch (Exception e) {
logger.warn("Cannot load in-cluster config, falling back to default");
ApiClient client = Config.defaultClient();
Configuration.setDefaultApiClient(client);
}
// Configure timeout
OkHttpClient httpClient = Configuration.getDefaultApiClient().getHttpClient()
.newBuilder()
.readTimeout(0, TimeUnit.SECONDS) // No timeout for watch
.build();
Configuration.getDefaultApiClient().setHttpClient(httpClient);
this.api = new CoreV1Api();
}
private void startWatching() {
watching = true;
// Watch ConfigMap in separate thread
scheduler.execute(this::watchConfigMap);
// Watch Secret in separate thread
scheduler.execute(this::watchSecret);
}
private void watchConfigMap() {
while (watching) {
try {
logger.info("Starting ConfigMap watch: {}/{}", namespace, configMapName);
Watch<V1ConfigMap> watch = Watch.createWatch(
Configuration.getDefaultApiClient(),
api.listNamespacedConfigMapCall(
namespace,
null, // pretty
false, // allowWatchBookmarks
null, // _continue
null, // fieldSelector
"metadata.name=" + configMapName, // labelSelector
null, // limit
null, // resourceVersion
null, // resourceVersionMatch
null, // timeoutSeconds
true, // watch
null // callback
),
new Watch.ResponseType<V1ConfigMap>() {}
);
for (Watch.Response<V1ConfigMap> item : watch) {
if (!watching) break;
V1ConfigMap configMap = item.object;
String type = item.type;
logger.info("ConfigMap {}: {}", type, configMap.getMetadata().getName());
if ("MODIFIED".equals(type)) {
publishReloadEvent("CONFIG", "ConfigMap modified");
}
}
} catch (ApiException e) {
logger.error("Kubernetes API error watching ConfigMap", e);
sleepBeforeRetry();
} catch (Exception e) {
if (watching) {
logger.error("Error watching ConfigMap", e);
sleepBeforeRetry();
}
}
}
}
private void watchSecret() {
while (watching) {
try {
logger.info("Starting Secret watch: {}/{}", namespace, secretName);
Watch<V1Secret> watch = Watch.createWatch(
Configuration.getDefaultApiClient(),
api.listNamespacedSecretCall(
namespace,
null, // pretty
false, // allowWatchBookmarks
null, // _continue
null, // fieldSelector
"metadata.name=" + secretName, // labelSelector
null, // limit
null, // resourceVersion
null, // resourceVersionMatch
null, // timeoutSeconds
true, // watch
null // callback
),
new Watch.ResponseType<V1Secret>() {}
);
for (Watch.Response<V1Secret> item : watch) {
if (!watching) break;
V1Secret secret = item.object;
String type = item.type;
logger.info("Secret {}: {}", type, secret.getMetadata().getName());
if ("MODIFIED".equals(type)) {
publishReloadEvent("SECRET", "Secret modified");
}
}
} catch (ApiException e) {
logger.error("Kubernetes API error watching Secret", e);
sleepBeforeRetry();
} catch (Exception e) {
if (watching) {
logger.error("Error watching Secret", e);
sleepBeforeRetry();
}
}
}
}
private void sleepBeforeRetry() {
try {
Thread.sleep(30000); // Wait 30 seconds before retry
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
}
}
private void publishReloadEvent(String configType, String message) {
ConfigReloadEvent event = new ConfigReloadEvent(this, configType, message);
eventPublisher.publishEvent(event);
}
}

Step 6: Configuration Reload Service

Configuration Reload Service

ConfigReloadService.java

package com.example.configreload.service;
import com.example.configreload.event.ConfigReloadEvent;
import com.example.configreload.model.AppConfig;
import com.example.configreload.model.AppSecrets;
import com.example.configreload.model.FeatureFlags;
import io.micrometer.core.instrument.MeterRegistry;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.ApplicationContext;
import org.springframework.context.event.EventListener;
import org.springframework.core.env.Environment;
import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Service;
import java.lang.reflect.Field;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicInteger;
@Service
public class ConfigReloadService {
private static final Logger logger = LoggerFactory.getLogger(ConfigReloadService.class);
private final ApplicationContext applicationContext;
private final Environment environment;
private final MeterRegistry meterRegistry;
private final AtomicInteger configReloadCount = new AtomicInteger(0);
private final AtomicInteger secretReloadCount = new AtomicInteger(0);
private final Map<String, Long> lastReloadTime = new ConcurrentHashMap<>();
@Autowired
@Qualifier("appConfig")
private AppConfig appConfig;
@Autowired(required = false)
@Qualifier("featureFlags")
private FeatureFlags featureFlags;
@Autowired(required = false)
@Qualifier("appSecrets")
private AppSecrets appSecrets;
public ConfigReloadService(ApplicationContext applicationContext, 
Environment environment,
MeterRegistry meterRegistry) {
this.applicationContext = applicationContext;
this.environment = environment;
this.meterRegistry = meterRegistry;
// Initialize metrics
initializeMetrics();
}
@Async
@EventListener
public void handleConfigReload(ConfigReloadEvent event) {
String configType = event.getConfigType();
String fileName = event.getFileName();
logger.info("Processing {} reload event for: {}", configType, fileName);
try {
switch (configType) {
case "CONFIG":
reloadConfiguration();
break;
case "SECRET":
reloadSecrets();
break;
default:
logger.warn("Unknown config type: {}", configType);
}
// Update metrics
updateReloadMetrics(configType, true);
} catch (Exception e) {
logger.error("Failed to reload {}: {}", configType, fileName, e);
updateReloadMetrics(configType, false);
}
}
private void reloadConfiguration() {
try {
// Reload AppConfig
if (appConfig != null) {
AppConfig newConfig = createNewAppConfig();
copyProperties(newConfig, appConfig);
logger.info("AppConfig reloaded successfully");
}
// Reload FeatureFlags
if (featureFlags != null) {
FeatureFlags newFlags = createNewFeatureFlags();
copyProperties(newFlags, featureFlags);
logger.info("FeatureFlags reloaded successfully");
}
// Refresh Spring beans that use @ConfigurationProperties
refreshConfigurationPropertiesBeans();
configReloadCount.incrementAndGet();
lastReloadTime.put("CONFIG", System.currentTimeMillis());
logger.info("Configuration reload completed successfully");
} catch (Exception e) {
logger.error("Failed to reload configuration", e);
throw new RuntimeException("Configuration reload failed", e);
}
}
private void reloadSecrets() {
try {
if (appSecrets != null) {
AppSecrets newSecrets = createNewAppSecrets();
copyProperties(newSecrets, appSecrets);
logger.info("Secrets reloaded successfully");
}
secretReloadCount.incrementAndGet();
lastReloadTime.put("SECRET", System.currentTimeMillis());
logger.info("Secrets reload completed successfully");
} catch (Exception e) {
logger.error("Failed to reload secrets", e);
throw new RuntimeException("Secrets reload failed", e);
}
}
private AppConfig createNewAppConfig() {
// This would typically re-read from the file system
// For simplicity, we're recreating from environment
AppConfig config = new AppConfig();
// In a real implementation, you would parse the YAML file again
return config;
}
private FeatureFlags createNewFeatureFlags() {
FeatureFlags flags = new FeatureFlags();
// Re-parse feature flags YAML
return flags;
}
private AppSecrets createNewAppSecrets() {
AppSecrets secrets = new AppSecrets();
// Re-read secrets from file system
return secrets;
}
private void copyProperties(Object source, Object target) throws Exception {
Field[] fields = source.getClass().getDeclaredFields();
for (Field field : fields) {
field.setAccessible(true);
Object value = field.get(source);
if (value != null) {
field.set(target, value);
}
}
}
private void refreshConfigurationPropertiesBeans() {
String[] beanNames = applicationContext.getBeanNamesForAnnotation(ConfigurationProperties.class);
for (String beanName : beanNames) {
Object bean = applicationContext.getBean(beanName);
try {
// Trigger re-initialization
applicationContext.getAutowireCapableBeanFactory().autowireBean(bean);
logger.debug("Refreshed configuration properties bean: {}", beanName);
} catch (Exception e) {
logger.warn("Failed to refresh bean: {}", beanName, e);
}
}
}
private void initializeMetrics() {
meterRegistry.gauge("config.reload.count", configReloadCount);
meterRegistry.gauge("secret.reload.count", secretReloadCount);
}
private void updateReloadMetrics(String configType, boolean success) {
String status = success ? "success" : "failure";
meterRegistry.counter("config.reloads",
"type", configType.toLowerCase(),
"status", status
).increment();
}
// Public methods for monitoring
public int getConfigReloadCount() {
return configReloadCount.get();
}
public int getSecretReloadCount() {
return secretReloadCount.get();
}
public Long getLastReloadTime(String configType) {
return lastReloadTime.get(configType);
}
public Map<String, Object> getReloadStats() {
return Map.of(
"configReloadCount", configReloadCount.get(),
"secretReloadCount", secretReloadCount.get(),
"lastConfigReload", lastReloadTime.get("CONFIG"),
"lastSecretReload", lastReloadTime.get("SECRET")
);
}
}

Step 7: Spring Configuration

Configuration Beans

AppConfiguration.java

package com.example.configreload.config;
import com.example.configreload.model.AppConfig;
import com.example.configreload.model.AppSecrets;
import com.example.configreload.model.FeatureFlags;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableAsync;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
@Configuration
@EnableAsync
public class AppConfiguration {
@Bean
@ConfigurationProperties(prefix = "app")
public AppConfig appConfig() {
return new AppConfig();
}
@Bean
@ConfigurationProperties(prefix = "features")
public FeatureFlags featureFlags() {
return new FeatureFlags();
}
@Bean
@ConfigurationProperties(prefix = "secrets")
public AppSecrets appSecrets() {
return new AppSecrets();
}
@Bean
public String databasePassword() throws IOException {
// Read password from secret file
Path secretPath = Paths.get("/etc/app/secrets/database-password");
if (Files.exists(secretPath)) {
return Files.readString(secretPath).trim();
}
return "default-password"; // Fallback for local development
}
@Bean
public String apiKey() throws IOException {
// Read API key from secret file
Path secretPath = Paths.get("/etc/app/secrets/api-key");
if (Files.exists(secretPath)) {
return Files.readString(secretPath).trim();
}
return "default-api-key"; // Fallback for local development
}
@Bean
public String jwtSecret() throws IOException {
// Read JWT secret from secret file
Path secretPath = Paths.get("/etc/app/secrets/jwt-secret");
if (Files.exists(secretPath)) {
return Files.readString(secretPath).trim();
}
return "default-jwt-secret"; // Fallback for local development
}
}

Application Properties

application.yaml

# Application configuration
app:
name: "Config Reload Demo"
version: "1.0.0"
config:
reload:
enabled: true
interval: 30000
# Spring configuration
spring:
application:
name: config-reload-demo
config:
import: 
- file:/etc/app/config/application.yaml
- file:/etc/app/config/feature-flags.yaml
profiles:
active: kubernetes
# Actuator endpoints
management:
endpoints:
web:
exposure:
include: health,info,metrics,configprops,env,reload
endpoint:
health:
show-details: always
show-components: always
reload:
enabled: true
info:
env:
enabled: true
# Logging
logging:
level:
com.example.configreload: INFO
org.springframework: WARN
pattern:
level: "%5p [${spring.application.name:},%X{traceId:-},%X{spanId:-}]"
# Kubernetes
kubernetes:
watch:
enabled: true

Step 8: REST API for Configuration Management

Configuration Controller

ConfigController.java

package com.example.configreload.controller;
import com.example.configreload.model.AppConfig;
import com.example.configreload.model.AppSecrets;
import com.example.configreload.model.FeatureFlags;
import com.example.configreload.service.ConfigReloadService;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.ApplicationContext;
import org.springframework.web.bind.annotation.*;
import java.util.Map;
@RestController
@RequestMapping("/api/v1/config")
public class ConfigController {
private final ApplicationContext applicationContext;
private final ConfigReloadService configReloadService;
private final AppConfig appConfig;
private final FeatureFlags featureFlags;
public ConfigController(ApplicationContext applicationContext,
ConfigReloadService configReloadService,
AppConfig appConfig,
FeatureFlags featureFlags) {
this.applicationContext = applicationContext;
this.configReloadService = configReloadService;
this.appConfig = appConfig;
this.featureFlags = featureFlags;
}
@GetMapping("/current")
public Map<String, Object> getCurrentConfig() {
return Map.of(
"appConfig", appConfig,
"featureFlags", featureFlags
);
}
@GetMapping("/reload/stats")
public Map<String, Object> getReloadStats() {
return configReloadService.getReloadStats();
}
@PostMapping("/reload")
public Map<String, String> triggerReload(@RequestParam(defaultValue = "CONFIG") String type) {
try {
switch (type.toUpperCase()) {
case "CONFIG":
configReloadService.reloadConfiguration();
break;
case "SECRET":
configReloadService.reloadSecrets();
break;
default:
return Map.of("status", "error", "message", "Invalid type: " + type);
}
return Map.of("status", "success", "message", type + " reload triggered");
} catch (Exception e) {
return Map.of("status", "error", "message", e.getMessage());
}
}
@GetMapping("/beans")
public Map<String, String> getConfigurationBeans() {
String[] beanNames = applicationContext.getBeanNamesForAnnotation(ConfigurationProperties.class);
return Map.of(
"configurationPropertiesBeans", String.join(", ", beanNames)
);
}
}

Actuator Custom Endpoint

ReloadEndpoint.java

package com.example.configreload.actuator;
import com.example.configreload.service.ConfigReloadService;
import org.springframework.boot.actuate.endpoint.annotation.Endpoint;
import org.springframework.boot.actuate.endpoint.annotation.ReadOperation;
import org.springframework.boot.actuate.endpoint.annotation.WriteOperation;
import org.springframework.stereotype.Component;
import java.util.Map;
@Component
@Endpoint(id = "reload")
public class ReloadEndpoint {
private final ConfigReloadService configReloadService;
public ReloadEndpoint(ConfigReloadService configReloadService) {
this.configReloadService = configReloadService;
}
@ReadOperation
public Map<String, Object> reloadInfo() {
return configReloadService.getReloadStats();
}
@WriteOperation
public Map<String, String> triggerReload(String type) {
try {
if ("config".equalsIgnoreCase(type)) {
configReloadService.reloadConfiguration();
return Map.of("status", "success", "message", "Configuration reloaded");
} else if ("secret".equalsIgnoreCase(type)) {
configReloadService.reloadSecrets();
return Map.of("status", "success", "message", "Secrets reloaded");
} else {
return Map.of("status", "error", "message", "Invalid type. Use 'config' or 'secret'");
}
} catch (Exception e) {
return Map.of("status", "error", "message", e.getMessage());
}
}
}

Step 9: Usage Examples

Database Service with Config Reload

DatabaseService.java

package com.example.configreload.service;
import com.example.configreload.model.AppConfig;
import com.zaxxer.hikari.HikariConfig;
import com.zaxxer.hikari.HikariDataSource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.event.EventListener;
import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Service;
import javax.sql.DataSource;
@Service
public class DatabaseService {
private static final Logger logger = LoggerFactory.getLogger(DatabaseService.class);
private final AppConfig appConfig;
private final String databasePassword;
private volatile HikariDataSource dataSource;
public DatabaseService(@Qualifier("appConfig") AppConfig appConfig,
@Qualifier("databasePassword") String databasePassword) {
this.appConfig = appConfig;
this.databasePassword = databasePassword;
this.dataSource = createDataSource();
}
public DataSource getDataSource() {
return dataSource;
}
@Async
@EventListener
public void handleConfigReload(com.example.configreload.event.ConfigReloadEvent event) {
if (event.isConfigChange() || event.isSecretChange()) {
logger.info("Recreating database connection pool due to config change");
recreateDataSource();
}
}
private synchronized void recreateDataSource() {
if (dataSource != null && !dataSource.isClosed()) {
dataSource.close();
}
dataSource = createDataSource();
logger.info("Database connection pool recreated");
}
private HikariDataSource createDataSource() {
var dbConfig = appConfig.getDatabase();
HikariConfig hikariConfig = new HikariConfig();
hikariConfig.setJdbcUrl(dbConfig.getUrl());
hikariConfig.setUsername("app_user"); // From config
hikariConfig.setPassword(databasePassword); // From secret
hikariConfig.setDriverClassName("org.postgresql.Driver");
// Connection pool configuration
hikariConfig.setMinimumIdle(dbConfig.getMinSize());
hikariConfig.setMaximumPoolSize(dbConfig.getMaxSize());
hikariConfig.setConnectionTimeout(dbConfig.getTimeout());
hikariConfig.setIdleTimeout(600000);
hikariConfig.setPoolName("AppConnectionPool");
logger.info("Creating database connection pool for: {}", dbConfig.getUrl());
return new HikariDataSource(hikariConfig);
}
}

Feature Flag Service

FeatureFlagService.java

package com.example.configreload.service;
import com.example.configreload.model.FeatureFlags;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.event.EventListener;
import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Service;
import java.util.Optional;
import java.util.concurrent.ThreadLocalRandom;
@Service
public class FeatureFlagService {
private static final Logger logger = LoggerFactory.getLogger(FeatureFlagService.class);
private final FeatureFlags featureFlags;
public FeatureFlagService(@Qualifier("featureFlags") FeatureFlags featureFlags) {
this.featureFlags = featureFlags;
}
public boolean isFeatureEnabled(String featureName) {
return Optional.ofNullable(featureFlags.getFeatures().get(featureName))
.map(FeatureFlags.FeatureFlag::isEnabled)
.orElse(false);
}
public boolean isFeatureEnabledForUser(String featureName, String userId) {
var feature = featureFlags.getFeatures().get(featureName);
if (feature == null || !feature.isEnabled()) {
return false;
}
// Check rollout percentage
if (feature.getRolloutPercentage() < 100) {
double random = ThreadLocalRandom.current().nextDouble(100.0);
return random < feature.getRolloutPercentage();
}
return true;
}
@Async
@EventListener
public void handleConfigReload(com.example.configreload.event.ConfigReloadEvent event) {
if (event.isConfigChange()) {
logger.info("Feature flags updated. New flags: {}", featureFlags.getFeatures().keySet());
}
}
public FeatureFlags getFeatureFlags() {
return featureFlags;
}
}

Step 10: Testing

Unit Tests

ConfigReloadServiceTest.java

package com.example.configreload.service;
import com.example.configreload.event.ConfigReloadEvent;
import com.example.configreload.model.AppConfig;
import com.example.configreload.model.FeatureFlags;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoExtension;
import org.springframework.context.ApplicationContext;
import static org.mockito.Mockito.*;
import static org.junit.jupiter.api.Assertions.*;
@ExtendWith(MockitoExtension.class)
class ConfigReloadServiceTest {
@Mock
private ApplicationContext applicationContext;
@Mock
private org.springframework.core.env.Environment environment;
@Mock
private io.micrometer.core.instrument.MeterRegistry meterRegistry;
private ConfigReloadService configReloadService;
private AppConfig appConfig;
private FeatureFlags featureFlags;
@BeforeEach
void setUp() {
appConfig = new AppConfig();
featureFlags = new FeatureFlags();
configReloadService = new ConfigReloadService(
applicationContext, environment, meterRegistry);
// Use reflection to set the fields for testing
setField(configReloadService, "appConfig", appConfig);
setField(configReloadService, "featureFlags", featureFlags);
}
@Test
void testHandleConfigReload() {
ConfigReloadEvent event = new ConfigReloadEvent(this, "CONFIG", "test.yaml");
assertDoesNotThrow(() -> configReloadService.handleConfigReload(event));
assertEquals(1, configReloadService.getConfigReloadCount());
}
@Test
void testGetReloadStats() {
var stats = configReloadService.getReloadStats();
assertNotNull(stats);
assertTrue(stats.containsKey("configReloadCount"));
assertTrue(stats.containsKey("secretReloadCount"));
}
private void setField(Object target, String fieldName, Object value) {
try {
var field = target.getClass().getDeclaredField(fieldName);
field.setAccessible(true);
field.set(target, value);
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}

Integration Test

ConfigReloadIntegrationTest.java

package com.example.configreload;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.web.client.TestRestTemplate;
import org.springframework.boot.test.web.server.LocalServerPort;
import org.springframework.http.ResponseEntity;
import org.springframework.test.context.ActiveProfiles;
import java.util.Map;
import static org.junit.jupiter.api.Assertions.*;
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@ActiveProfiles("test")
class ConfigReloadIntegrationTest {
@LocalServerPort
private int port;
@Autowired
private TestRestTemplate restTemplate;
@Test
void testConfigEndpoint() {
ResponseEntity<Map> response = restTemplate.getForEntity(
"http://localhost:" + port + "/api/v1/config/current", Map.class);
assertEquals(200, response.getStatusCodeValue());
assertNotNull(response.getBody());
assertTrue(response.getBody().containsKey("appConfig"));
}
@Test
void testReloadStatsEndpoint() {
ResponseEntity<Map> response = restTemplate.getForEntity(
"http://localhost:" + port + "/api/v1/config/reload/stats", Map.class);
assertEquals(200, response.getStatusCodeValue());
assertNotNull(response.getBody());
}
}

Best Practices

1. Security Considerations

  • Never log sensitive configuration values
  • Use Kubernetes RBAC to restrict access to Secrets
  • Encrypt sensitive data at rest and in transit
  • Regularly rotate secrets and certificates

2. Performance Optimization

  • Use efficient file watching mechanisms
  • Implement debouncing for frequent changes
  • Cache configuration values appropriately
  • Monitor memory usage during reloads

3. Reliability

  • Implement circuit breakers for configuration reloads
  • Maintain fallback configuration values
  • Test configuration changes in staging first
  • Implement rollback mechanisms

4. Monitoring

  • Track configuration reload success/failure rates
  • Monitor application behavior after configuration changes
  • Set up alerts for configuration reload failures
  • Log configuration changes for audit purposes

Conclusion

This comprehensive ConfigMap and Secret reloading implementation provides:

  • Multiple Strategies: File system watching, Kubernetes API watching, and polling
  • Spring Integration: Seamless integration with Spring Boot configuration properties
  • Type Safety: Strongly typed configuration models with validation
  • Monitoring: Comprehensive metrics and health checks
  • Security: Proper handling of sensitive data
  • Reliability: Fallback mechanisms and error handling

Key Benefits:

  1. Zero Downtime: Reload configuration without restarting the application
  2. Real-time Updates: Immediate propagation of configuration changes
  3. Kubernetes Native: Full integration with Kubernetes ecosystem
  4. Observability: Comprehensive monitoring and metrics
  5. Developer Experience: Simple API for configuration management

By implementing this solution, you can achieve dynamic configuration management that scales with your application's needs while maintaining security and reliability.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper