I currently am working on adding a new secret for our project which usually stores secrets in Kubernetes. I pretty much mimicked all the other secrets that I could find, so it would seem that everything should be correct. However, it's not working and giving me for: "kubernetes/template/secrets.yml": error decoding from json: illegal base64 data at input byte 0. I'm not sure if this is an issue from within Kubernetes or from my script.

The secrets file looks something like this:

secrets.yml

apiVersion: v1
kind: Secret
metadata:
  …
type: Opaque
data:
  SECRET_A: {SECRET_A}
  SECRET_B: {SECRET_B}

deployk8.sh

set -e

sed -i "s,{SECRET_A},${SECRET_A},g" kubernetes/template/secrets.yml
sed -i "s,{SECRET_B},${SECRET_B},g" kubernetes/template/secrets.yml # The new one

kubectl --record --namespace=${...} --token ${...} --cluster ${...} apply -f kubernetes/template/secrets.yml

When I run kubectl get secret my-secret -o json, I get something similar to this:

{
    "apiVersion": "v1",
    "data": {
        "SECRET_A": "abcdefghijklmnopqrstuvwxyz123456",
        "SECRET_B": "abcdefghijklmnopqrstuvwxyz1234567890abcd"
    },
    "kind": "Secret",
    "metadata": {
        "annotations": {
            "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"data\":{\"SECRET_A\":\"abcdefghijklmnopqrstuvwxyz123456\"},\"kind\":\"Secret\",\"metadata\":{\"annotations\":{\"kubernetes.io/change-cause\":\"kubectl apply --record=true --namespace=ns --token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --cluster=my_cluster --filename=kubernetes/template/secrets.yml\"},\"labels\":{\"app\":\"my-app\",\"env\":\"dev\"},\"name\":\"my-app-dev\",\"namespace\":\"ns\"},\"type\":\"Opaque\"}\n",
            "kubernetes.io/change-cause": "kubectl apply --record=true --namespace=ns --token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx--cluster=my_cluster --filename=kubernetes/template/secrets.yml"
        },
        "creationTimestamp": "20XX-XX-XXTXX:XX:XXZ",
        "labels": {
            "app": "my-app",
            "env": "dev"
        },
        "name": "my-app-dev",
        "namespace": "ns",
        "resourceVersion": "0000000000",
        "selfLink": "/api/v1/namespaces/ns/secrets/my-app-dev",
        "uid": "00000000-0000-0000-0000-000000000000"
    },
    "type": "Opaque"
}

The entire error looks something like this:

  kubectl --record --namespace=${...} --token ${...} --cluster ${...} apply -f 
  kubernetes/template/secrets.yml
  Error from server: error when applying patch:
  [inset output from above, but with:
    {\"SECRET_A\":\"abcdefghijklmnopqrstuvwxyz123456\",\"SECRET_B\":\"$SECRET_B\"}]
  to:
  [transformed output from above, but with:
    Object: &{map["apiVersion":"v1" "data":map["SECRET_A":"abcdefghijklmnopqrstuvwxyz123456\" "SECRET_B":"abcdefghijklmnopqrstuvwxyz1234567890abcd"]]

I would really appreciate any help in figuring this out!