Decode every value in a Secret at once, spot trailing newlines, or create a Secret from KEY=value lines.

Base64 is not encryption

Anyone who can read the manifest can read the values. Do not commit Secrets to Git. Keep the values in a vault and sync them with External Secrets Operator, Sealed Secrets or the Secrets Store CSI driver.

Input formats for Create a Secret

The format is detected automatically: .env lines (quoted values may span several lines, so a PEM key can be pasted as is), docker-compose environment: blocks or - KEY=value lists, a JSON object, the output of aws secretsmanager get-secret-value or vault kv get -format=json, YAML maps, .NET appsettings.json (comments and trailing commas are fine) and Azure Functions local.settings.json, where only Values and ConnectionStrings are used. Keys written with :, such as Section:Key, become Section__Key: a colon is not allowed in Secret keys or Linux env var names.

Nested sections are flattened with __ by default, which is how .NET and most config libraries map environment variables to nested settings. Only the sensitive parts (connection strings, keys, passwords) belong in a Secret; URLs and template IDs can go in a ConfigMap.

envFrom:
  - secretRef:
      name: app-secrets
# or mount the whole file:
volumeMounts:
  - name: settings
    mountPath: /app/appsettings.Production.json
    subPath: appsettings.json

The trailing newline problem

echo 'value' | base64 encodes a newline at the end, and the app then receives value\n. Passwords that “look right” but fail to authenticate are often this. Use echo -n or printf '%s'. This tool flags values that end with a newline.

kubectl get secret app-secrets -o jsonpath='{.data.DB_PASSWORD}' | base64 -d
kubectl create secret tls app-tls --cert=tls.crt --key=tls.key

Kubernetes Secret decoder

Base64 is not encryption

Input formats for Create a Secret

The trailing newline problem