What is konfig?

Konfig lets applications running on Google Cloud's serverless platforms, Cloud Run and Cloud Functions, pull configuration values and secrets from a Kubernetes cluster at runtime. Instead of duplicating config files or API keys across multiple services, you store them once in a Kubernetes cluster and reference them from your serverless workloads, which then automatically receive the actual values when they start up. The way it works is straightforward. You add a single import line to your application code, and behind the scenes the library intercepts the environment variables that were set when your service was deployed. When it sees a special reference string pointing to a Kubernetes configmap or secret, it reaches out to the cluster, fetches the actual value, and swaps it in. For file-based configs like a JSON database connection file, it can even write the contents to a temporary file and give your app the file path instead of the raw content. This is useful for teams already using Google Kubernetes Engine (GKE) who want a central place to manage secrets and configuration across both containerized and serverless workloads. For example, if you have a database password stored as a Kubernetes secret, both a traditional service running in GKE and a Cloud Run function can reference the same source of truth without you having to manage separate secret stores or copy values around. One notable design choice is that konfig reads environment variable definitions from the Cloud Run or Cloud Functions API rather than scanning the runtime environment directly. This avoids a common pitfall where other libraries might set or modify environment variables before konfig runs, which could cause confusion. It also means the GKE cluster is used purely as a storage layer, the tutorial even shows you can delete the cluster's compute nodes after setup, since only the Kubernetes API server is needed to serve config and secret lookups.