如何解决 Kubernetes 机密的“来自 json 的错误解码：输入字节 0 处的非法 base64 数据”？答案

【问题标题】：How can I resolve the "error decoding from json: illegal base64 data at input byte 0" for Kubernetes secrets?如何解决 Kubernetes 机密的“来自 json 的错误解码：输入字节 0 处的非法 base64 数据”？
【发布时间】：2020-02-15 18:37:34
【问题描述】：

我目前正在为我们的项目添加一个新的秘密，它通常将秘密存储在 Kubernetes 中。我几乎模仿了我能找到的所有其他秘密，所以看起来一切都应该是正确的。但是，它不起作用并给我for: "kubernetes/template/secrets.yml": error decoding from json: illegal base64 data at input byte 0。我不确定这是 Kubernetes 内部的问题还是我的脚本的问题。

秘密文件看起来像这样：

secrets.yml

apiVersion: v1
kind: Secret
metadata:
  …
type: Opaque
data:
  SECRET_A: {SECRET_A}
  SECRET_B: {SECRET_B}

deployk8.sh

set -e

sed -i "s,{SECRET_A},${SECRET_A},g" kubernetes/template/secrets.yml
sed -i "s,{SECRET_B},${SECRET_B},g" kubernetes/template/secrets.yml # The new one

kubectl --record --namespace=${...} --token ${...} --cluster ${...} apply -f kubernetes/template/secrets.yml

当我运行kubectl get secret my-secret -o json 时，我得到类似这样的东西：

{
    "apiVersion": "v1",
    "data": {
        "SECRET_A": "abcdefghijklmnopqrstuvwxyz123456",
        "SECRET_B": "abcdefghijklmnopqrstuvwxyz1234567890abcd"
    },
    "kind": "Secret",
    "metadata": {
        "annotations": {
            "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"data\":{\"SECRET_A\":\"abcdefghijklmnopqrstuvwxyz123456\"},\"kind\":\"Secret\",\"metadata\":{\"annotations\":{\"kubernetes.io/change-cause\":\"kubectl apply --record=true --namespace=ns --token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --cluster=my_cluster --filename=kubernetes/template/secrets.yml\"},\"labels\":{\"app\":\"my-app\",\"env\":\"dev\"},\"name\":\"my-app-dev\",\"namespace\":\"ns\"},\"type\":\"Opaque\"}\n",
            "kubernetes.io/change-cause": "kubectl apply --record=true --namespace=ns --token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx--cluster=my_cluster --filename=kubernetes/template/secrets.yml"
        },
        "creationTimestamp": "20XX-XX-XXTXX:XX:XXZ",
        "labels": {
            "app": "my-app",
            "env": "dev"
        },
        "name": "my-app-dev",
        "namespace": "ns",
        "resourceVersion": "0000000000",
        "selfLink": "/api/v1/namespaces/ns/secrets/my-app-dev",
        "uid": "00000000-0000-0000-0000-000000000000"
    },
    "type": "Opaque"
}

整个错误看起来像这样：

  kubectl --record --namespace=${...} --token ${...} --cluster ${...} apply -f 
  kubernetes/template/secrets.yml
  Error from server: error when applying patch:
  [inset output from above, but with:
    {\"SECRET_A\":\"abcdefghijklmnopqrstuvwxyz123456\",\"SECRET_B\":\"$SECRET_B\"}]
  to:
  [transformed output from above, but with:
    Object: &{map["apiVersion":"v1" "data":map["SECRET_A":"abcdefghijklmnopqrstuvwxyz123456\" "SECRET_B":"abcdefghijklmnopqrstuvwxyz1234567890abcd"]]

如果能帮我解决这个问题，我将不胜感激！

【问题讨论】：

@curiosa 它只是一个占位符，而不是真正的价值。尽管如此，我可以输入上面的这两个值，但对于 SECRET_B（而不是 SECRET_A）仍然会出现相同的错误。
我希望建议在更改后查看 secrets.yml 不会太琐碎？
去github.com/kubernetes-sigs/kustomize
我在弄乱代码时遇到的另一个错误是error validating data: ValidationError(Secret.data.SECRET_B): invalid type for io.k8s.api.core.v1.Secret.data: got "map", expected "string"; 它似乎来自我上面添加的secrets.yml 文件。

标签： json kubernetes yaml

【解决方案1】：

我想我找到了解决问题的方法。事实证明，我从中提取的环境变量发生了变化（即SECRET_B 应该只是B）。所以，从技术上讲，SECRET_B 并不存在。改变这个设法解决了我的问题。感谢所有试图提供帮助的人！

【讨论】：

【解决方案2】：

您可以使用 stringData 字段，如 here 所述。这样你就不必对输入进行base64。请注意，该字段是只写的。

【讨论】：