| Resource | Purpose |
|---|---|
| ConfigMap | Non-sensitive config (env vars, config files) |
| Secret | Sensitive config (base64-encoded by default — NOT encrypted at rest unless KMS-enabled) |
| PersistentVolume (PV) | A piece of storage in the cluster |
| PersistentVolumeClaim (PVC) | A request for storage by a pod |
| StorageClass | Defines how PVs get provisioned dynamically (e.g., gp3 on EKS) |