Kubernetes Configuration Strategy.

An AEM OSGi adapter and its containerized integration API both need explicit endpoint and timeout configuration. They should share a documented contract without sharing a configuration mechanism or assuming that AEM itself runs in the cluster.

Hard-coded hosts, copied credentials and environment-specific images make promotion difficult to audit. Defaults that silently select a developer endpoint can also make a deployment appear healthy while connecting to the wrong system.

Use ConfigMaps for non-sensitive inputs and a controlled secret-delivery mechanism for credentials. Kubernetes Secret values are not protected merely by base64 encoding; access controls, storage protection and restrictions on workload access are separate responsibilities.

Define required fields, accepted formats and safe bounds for connection pools and timeouts. Promote a digest-pinned image alongside versioned configuration references, and fail startup clearly when required inputs are missing.

• Record a non-sensitive configuration revision in deployment metadata.
• Keep credentials out of Git, logs, image layers and diagnostic dumps.
• Document whether each setting is read at startup or reloaded, rather than assuming a ConfigMap update changes a running process.

Provision the new credential, update its reference and validate authentication before retiring the previous credential where the upstream system permits overlap. Environment-variable consumers need replacement processes; mounted-file consumers still need an application reload strategy.

Compare desired configuration references with the running release and inspect only redacted diagnostic information. Assign ownership for expiration, rotation failures and emergency access; a secret object alone does not supply those operational processes.

Reloading can avoid a rollout but adds application complexity around partial updates and connection renewal. Process replacement is easier to reason about, provided availability and dependency capacity support it.

Continue with the complementary design in AEM 6.5 LTS Modernization: Java, OSGi and Legacy Code Readiness.

The design aims for clearer environment separation and consistent deployment inputs. Evidence should show what changed without revealing sensitive values.

• Start the service with a missing or malformed required setting and verify an actionable, redacted error.
• Rotate a credential during traffic and inspect old and new connection behavior.
• Revert an ordinary configuration revision and verify the image digest is unchanged.
• Audit permissions so unrelated workloads cannot read the service's credentials.

Cloud readiness depends on explicit assumptions, not on moving values into a different file. The contract must include ownership, validation, activation and recovery for every consequential setting.

These sources document product behavior. The design and validation approach above are engineering proposals, not claims made by the vendors.

• Kubernetes: ConfigMaps
• Kubernetes: Secrets