[SOLVED] Can Kubernetes secrets store newlines?

Can Kubernetes secrets store newlines?

I've created a secret from a file using a command like:

kubectl create secret generic laravel-oauth \
        --from-file=./.work-in-progress/oauth_private.key \
        --from-file=./.work-in-progress/oauth_public.key

However it seems new lines are stripped from the files (when using the secrets as ENV variables).

There is a 'encoding' note in the docs that state:

The serialized JSON and YAML values of secret data are encoded as base64 strings. Newlines are not valid within these strings and must be omitted. When using the base64 utility on Darwin/macOS users should avoid using the -b option to split long lines. Conversely Linux users should add the option -w 0 to base64 commands or the pipeline base64 | tr -d '\n' if -w option is not available.

However I assumed this only applies for 'manually' created secrets via YAML files.

Solution

The new lines are not stripped the files are just base64 encoded as mentioned in the other answers too. For example:

# mycert.pem
-----BEGIN CERTIFICATE-----
xxxxxx
xxxxxx
...
-----END CERTIFICATE-----

Then:

$ kubectl create secret generic mysecret --from-file=./cert.pem

Then:

$ kubectl get secret mysecret -o=yaml

apiVersion: v1
data:
  cert.pem: <base64 encoded string>
kind: Secret
metadata:
  creationTimestamp: 2018-11-14T18:11:46Z
  name: mysecret
  namespace: default
  resourceVersion: "20180431"
  selfLink: /api/v1/namespaces/default/secrets/mysecret
  uid: xxxxxx
type: Opaque

Then if you decode it, you will get the original secret.

$ echo '<base64 encoded string>' | base64 -D
-----BEGIN CERTIFICATE-----
xxxxxx
xxxxxx
...
-----END CERTIFICATE-----

Also, this is not necessarily secure at rest. If you are looking for more security you can use something like Hashicorp Vault or as alluded by @Alex Bitnami's sealed secrets.