How should I split a frontend, backend, and database in Kubernetes?

Start with a ConfigMap for non-sensitive settings like the database host, port, and database name. Put credentials in a Secret, then expose both to the backend container as environment variables or mounted files.

A Secret is not automatically a complete secrets management system. Limit who can read it, and check how your cluster protects Secret data at rest. If you inject values as environment variables, changing the ConfigMap or Secret does not update the environment of an already running container. You'll need to restart the affected Pods.

Keep the database out of the backend Pod. Deploy the frontend and backend separately, with a Service giving the backend a stable address. The backend can reach the database through its own Service if the database runs in the cluster.

A PersistentVolumeClaim isn't a database. It's a request for storage that a database workload can use. For a small learning setup, you could run the database as a StatefulSet with persistent storage. That still leaves you responsible for backups, restores, upgrades, and recovery.

A database operator such as CloudNativePG is another option for PostgreSQL. It manages more of the database lifecycle, but adds another component to learn. An external managed database avoids running the database in Kubernetes altogether, while the backend still needs its connection settings and credentials.

For a test project, ConfigMaps and Secrets are enough to get moving. You don't need a separate configuration or secrets platform just to pass a database URL to an app.

If you later manage configuration through Git, be careful not to commit plaintext credentials. Tools such as SOPS or Sealed Secrets can help manage encrypted secrets in that workflow. A dedicated secrets service is another option when the extra complexity is worthwhile.

One frontend wrinkle: a React app running in a browser can't use the backend's cluster-only Service name directly. The browser needs an address it can reach, usually through an ingress or another public endpoint.

Also, frontend environment variables may be baked into the built files rather than read when the container starts. Check your build tooling before expecting a Kubernetes ConfigMap change to update the browser's API address. Never put database credentials in frontend configuration.